Not rated
CVE-2022-1941 A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3,…
Description
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| protobuf-cpp 3.21 | earliest → 3.21.5 | No fix stated |
| protobuf-cpp 3.20 | earliest → 3.20.1 | No fix stated |
| protobuf-cpp 3.19 | earliest → 3.19.4 | No fix stated |
| protobuf-cpp 3.18 | earliest → 3.18.2 | No fix stated |
| protobuf-cpp 3.17 | earliest → 3.17.3 | No fix stated |
| protobuf-cpp 3.16 | earliest → 3.16.1 | No fix stated |
| protobuf-python 4.21 | earliest → 4.21.5 | No fix stated |
| protobuf-python 3.20 | earliest → 3.20.1 | No fix stated |
| protobuf-python 3.19 | earliest → 3.19.4 | No fix stated |
Show the 11 other branches Hide the 11 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| protobuf-python 3.18 | earliest → 3.18.2 | No fix stated |
| protobuf-python 3.17 | earliest → 3.17.3 | No fix stated |
| protobuf-python 3.16 | earliest → 3.16.1 | No fix stated |
| protobuf-cpp 3.21 | 3.21.0 → < 3.21.6 | 3.21.6 |
| protobuf-cpp 3.20 | 3.20.0 → < 3.20.2 | 3.20.2 |
| protobuf-cpp 3.19 | 3.19.0 → < 3.19.5 | 3.19.5 |
| protobuf-cpp 3.18 | earliest → < 3.18.3 | 3.18.3 |
| protobuf-python 4.0 | 4.0.0 → < 4.21.6 | 4.21.6 |
| protobuf-python 3.20 | 3.20.0 → < 3.20.2 | 3.20.2 |
| protobuf-python 3.19 | 3.19.0 → < 3.19.5 | 3.19.5 |
| protobuf-python 3.18 | earliest → < 3.18.3 | 3.18.3 |