CVE-2022-3171: Memory handling vulnerability in ProtocolBuffers Java core and lite
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Other sources
A potential Denial of Service issue in protobuf-java core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.
— Red Hat
Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. An attacker could exploit this vulnerability using a method call to obtain sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/protobuf-javato a version that resolves this vulnerability.Fixed in 3.21.7 - Upgrade
Upgrade
redhat/protobuf-javato a version that resolves this vulnerability.Fixed in 3.20.3 - Upgrade
Upgrade
redhat/protobuf-javato a version that resolves this vulnerability.Fixed in 3.19.6 - Upgrade
Upgrade
redhat/protobuf-javato a version that resolves this vulnerability.Fixed in 3.16.3 - Upgrade
Upgrade
debian/protobufto a version that resolves this vulnerability.Fixed in 3.21.12-3+deb12u1Fixed in 3.21.12-11+deb13u1Fixed in 3.21.12-17 - Upgrade
Upgrade
debian/protobufto a version that resolves this vulnerability.Fixed in 3.21.9-3 - Upgrade
Upgrade
protobuf-javato a version that resolves this vulnerability.Fixed in 3.21.7 - Upgrade
Upgrade
protobuf-javato a version that resolves this vulnerability.Fixed in 3.20.3 - Upgrade
Upgrade
protobuf-javato a version that resolves this vulnerability.Fixed in 3.19.6 - Upgrade
Upgrade
protobuf-javato a version that resolves this vulnerability.Fixed in 3.16.3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-3171.
What is the severity level of CVE-2022-3171?
CVE-2022-3171 has a severity level of high.
How can this vulnerability be exploited?
This vulnerability can be exploited through malicious inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields.
What is the affected software and versions?
The affected software is protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3.
What is the recommended remedy for this vulnerability?
To mitigate this vulnerability, update the protobuf-java package to version 3.21.7, 3.20.3, 3.19.6, or 3.16.3.