Affected: AlmaLinux:8: protobuf, AlmaLinux:8: protobuf-compiler, AlmaLinux:8: protobuf-devel, AlmaLinux:8: protobuf-lite, AlmaLinux:8: protobuf-lite-devel, AlmaLinux:8: python3-protobuf

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.

Security Fix(es):

* protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference (CVE-2021-22570)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Withdrawn by the publisher.

Affected: Homebrew: duplicity

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

Affected: CleanStart: apache-hive, CleanStart: spark-sc213-jdk17-py312

CVE-2021-22570 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

Withdrawn by the publisher.

Affected: NuGet: Google.Protobuf, Packagist: google/protobuf, Maven: com.google.protobuf:protobuf-java, Go: github.com/protocolbuffers/protobuf, PyPI: protobuf

### Withdrawn Advisory

This advisory has been withdrawn because the protobuf vulnerability comes from the compiler rather that the code. This link is maintained to preserve external references.

### Original Description

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

Affected: openEuler:20.03-LTS-SP1: protobuf

Protocol Buffers (a.k.a., protobuf) are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can find protobuf's documentation on the Google Developers site. Security Fix(es): Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.(CVE-2021-22570)

Security update for protobuf

Affected: PyPI: protobuf

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference

Security update for protobuf

Affected: Ubuntu:Pro:14.04:LTS: protobuf, Ubuntu:Pro:16.04:LTS: protobuf, Ubuntu:18.04:LTS: protobuf, Ubuntu:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.