CVE-2022-1941

Katalog CVE

CVSS 7.5 · High EPSS 1,5%

Kerentanan Improper Validation of Syntactic Correctness of Input pada google protobuf-cpp, google protobuf-python +2 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

Rincian

Terbit di NVD

22 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1286: Improper Validation of Syntactic Correctness of Input

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2022/09/27/1 mailing list · advisory pihak ketiga
• https://cloud.google.com/support/bulletins#GCP-2022-019 advisory pihak ketiga
• https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html mailing list
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4TI...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MPCGUT3T5L6C3...
• https://security.netapp.com/advisory/ntap-20240705-0001/