CVE-2019-15544: High severity protocol buffers vulnerability
Published Aug 26, 2019
·Updated
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
Affected Software
3 affected components
Rust-protobuf Project Rust-protobuf<1.7.5
Rust-protobuf Project Rust-protobuf>=2.0.0<2.6.0
Apache HBase=2.2.3
Event History
Aug 26, 2019
CVE Published
via MITRE·05:08 PM
Data Sourced
via MITRE·05:08 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-15544?
The severity of CVE-2019-15544 is classified as high due to its potential to lead to memory exhaustion attacks.
2
How do I fix CVE-2019-15544?
To fix CVE-2019-15544, upgrade the protobuf crate to version 2.6.0 or later.
3
Which versions of the protobuf crate are affected by CVE-2019-15544?
CVE-2019-15544 affects all versions of the protobuf crate prior to 2.6.0.
4
Can CVE-2019-15544 impact Apache HBase?
Yes, CVE-2019-15544 can impact Apache HBase version 2.2.3 when using the affected protobuf library.
5
What kind of attack can exploit CVE-2019-15544?
CVE-2019-15544 can be exploited through crafted Vec::reserve calls that lead to memory exhaustion.