CVE-2021-22570: Nullptr Dereference in Protobuf
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-22570?
The severity of CVE-2021-22570 is high with a CVSS score of 7.5.
What is the recommended upgrade for CVE-2021-22570?
We recommend upgrading to version 3.15.0 of com.google.protobuf:protobuf-java.
Which software packages are affected by CVE-2021-22570?
The following software packages are affected by CVE-2021-22570: com.google.protobuf:protobuf-java, protobuf, github.com/protocolbuffers/protobuf, google/protobuf, Google Protobuf, Debian Debian Linux, Fedoraproject Fedora, Oracle MySQL, Apple iPadOS, Apple watchOS, NetApp OnCommand Insight, NetApp OnCommand Workflow Automation, Netapp Snapcenter.
Where can I find more information about CVE-2021-22570?
You can find more information about CVE-2021-22570 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-22570), [GitHub](https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0), [Fedora Project](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFX6KPNOFHYD6L4XES5PCM3QNSKZBOTQ/).
What is the CWE category of CVE-2021-22570?
The CWE category of CVE-2021-22570 is CWE-476 (NULL Pointer Dereference).