REDHAT-BUG-2498127: High severity protobufjs vulnerability
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
protobufjsto a version that resolves this vulnerability.Fixed in 8.6.6
Event History
Frequently Asked Questions
What attacker-controlled input is required to trigger the issue?
An attacker must be able to supply a crafted .proto schema that starts an option declaration but ends before an = token is present. Processing that schema through parse, Root.load, or Root.loadSync can then loop indefinitely.
Which protobufjs versions are fixed?
The issue is fixed in protobufjs versions 7.6.5 and 8.6.6. Versions prior to those releases are affected according to the available information.
What is the practical impact if exploitation succeeds?
The affected parsing operation can loop indefinitely, which can prevent the application from completing processing of the supplied schema.