Vulnerability Description
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Google-Protobuf | < 3.16.3 | |
| Protobuf-Java | < 3.16.3 | |
| Protobuf-Javalite | < 3.16.3 | |
| Protobuf-Kotlin | < 3.16.3 | |
| Protobuf-Kotlin-Lite | < 3.16.3 | |
| Fedoraproject | Fedora | 37 |
Related Weaknesses (CWE)
References
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-jThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202301-09Third Party Advisory
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-jThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202301-09Third Party Advisory
FAQ
What is CVE-2022-3171?
CVE-2022-3171 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-...
How severe is CVE-2022-3171?
CVE-2022-3171 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-3171?
Check the references section above for vendor advisories and patch information. Affected products include: Google Google-Protobuf, Google Protobuf-Java, Google Protobuf-Javalite, Google Protobuf-Kotlin, Google Protobuf-Kotlin-Lite.