CVE-2022-1941 — Improper Validation of Syntactic Correctness of Input in Google Protobuf-cpp

CWE-1286 — Improper Validation of Syntactic Correctness of InputCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer13 documents9 sources
Severity
7.5HIGHNVD
OSV8.8OSV5.5
EPSS
0.2%
top 61.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
33
Google ProtobufGoogle Protobuf-cppGoogle Protobuf-python+30 more
Timeline
PublishedSep 22
Latest updateFeb 14

Description

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upg…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages33 packages

▶NVDgoogle/protobuf-python3.19.0 — 3.19.5+3
▶CVEListV5google_llc/protobuf-pythonunspecified — 3.16.1
▶PyPIgoogle/protobuf3.19.0 — 3.19.5+3
▶debiandebian/protobuf< protobuf 3.21.9-3 (bookworm)
▶NVDgoogle/protobuf-cpp3.19.0 — 3.19.5+3

Also affects: Debian Linux 10.0, Fedora 36, 37

🔴Vulnerability Details

5
OSV
protobuf vulnerabilities↗2023-03-13
▶
OSV
protobuf vulnerabilities↗2022-12-08
▶
GHSA
protobuf-cpp and protobuf-python have potential Denial of Service issue↗2022-09-23
▶
OSV
protobuf-cpp and protobuf-python have potential Denial of Service issue↗2022-09-23
▶
OSV
CVE-2022-1941: A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3↗2022-09-22
▶

📋Vendor Advisories

7
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS↗2024-02-14
▶
Ubuntu
Protocol Buffers vulnerabilities↗2023-03-13
▶
Oracle
Oracle Oracle MySQL Risk Matrix: Connector/Python (Python) — CVE-2022-1941↗2023-01-15
▶
Ubuntu
protobuf vulnerabilities↗2022-12-08
▶
Red Hat
protobuf: message parsing vulnerability in ProtocolBuffers↗2022-09-22
▶