GHSA-7gcm-g887-7qv7: Pip/protobuf vulnerability
A denial-of-service (DoS) vulnerability exists in google.protobuf.jsonformat.ParseDict() in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/protobufto a version that resolves this vulnerability.Fixed in 6.33.5
Event History
Frequently Asked Questions
What is the severity of GHSA-7gcm-g887-7qv7?
The GHSA-7gcm-g887-7qv7 vulnerability is classified as a denial-of-service (DoS) issue.
How do I fix GHSA-7gcm-g887-7qv7?
To fix GHSA-7gcm-g887-7qv7, upgrade the protobuf package to a version higher than 6.33.4 where the issue is addressed.
Who is affected by GHSA-7gcm-g887-7qv7?
The vulnerability GHSA-7gcm-g887-7qv7 affects users of the protobuf package version 6.33.4 and below.
What causes GHSA-7gcm-g887-7qv7?
GHSA-7gcm-g887-7qv7 is caused by missing recursion depth accounting in the google.protobuf.json_format.ParseDict() function when handling nested google.protobuf.Any messages.
Can GHSA-7gcm-g887-7qv7 be exploited remotely?
Yes, GHSA-7gcm-g887-7qv7 can be exploited remotely by attackers to achieve denial of service.