Most recent entries from all

bdu:2023-03823

certfr-2022-avi-363 — De multiples vulnérabilités ont été découvertes dans Oracle Database Server. Certaines d'entre elles permettent à un at…

certfr-2022-avi-363

Withdrawn: CLEANSTART-2026-JU62349 — Security fixes for CVE-2018-10237, CVE-2020-8908, CVE-2021-22569, CVE-2021-22570, CVE-2022-3171, CVE-2022-3509, CVE-202…

Withdrawn by the publisher.

Affected: CleanStart: apache-hive

Multiple security vulnerabilities affect the apache-hive package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-232104

fkie_cve-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

GHSA-wrvw-hg22-4m67 — A potential Denial of Service issue in protobuf-java

Affected: Maven: com.google.protobuf:protobuf-java, RubyGems: google-protobuf, Maven: com.google.protobuf:protobuf-kotlin

## Summary

A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data.

Reporter: [OSS-Fuzz](https://github.com/google/oss-fuzz)

Affected versions: All versions of Java Protobufs (including Kotlin and JRuby) prior to the versions listed below. Protobuf "javalite" users (typically Android) are not affected.

## Severity

[CVE-2021-22569](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22569) **High** - CVSS Score: 7.5, An implementation weakness in how unknown fields are parsed in Java. A small (~800 KB) malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated GC pauses.

## Proof of Concept

For reproduction details, please refer to the oss-fuzz issue that identifies the specific inputs that exercise this parsing weakness.

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

- protobuf-java (3.16.1, 3.18.2, 3.19.2) - protobuf-kotlin (3.18.2, 3.19.2) - google-protobuf [JRuby gem only] (3.19.2)

gsd-2021-22569

msrc_CVE-2021-22569 — Denial of Service of protobuf-java parsing procedure

msrc_CVE-2021-22569

OESA-2022-1694 — protobuf security update

Affected: openEuler:22.03-LTS: protobuf

Protocol Buffers (a.k.a., protobuf) are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can find protobuf's documentation on the Google Developers site. Security Fix(es): An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.(CVE-2021-22569)

RHSA-2022:1013 — Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update

guava: local information disclosure via temporary directory created with unsafe permissions bouncycastle: Timing issue within the EC math library mysql-connector-java: unauthorized access to critical kubernetes-client: Insecure deserialization in unmarshalYaml method protobuf-java: potential DoS in the parsing procedure for binary data maven: Block repositories using http by default jersey: Local information disclosure via system temporary directory jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way xml-security: XPath Transform abuse allows for information disclosure cron-utils: template Injection leading to unauthenticated Remote Code Execution h2: Remote Code Execution in Console

SUSE-SU-2023:2783-2 — Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcry…

Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets

UBUNTU-CVE-2021-22569

Affected: Ubuntu:Pro:14.04:LTS: protobuf, Ubuntu:Pro:16.04:LTS: protobuf, Ubuntu:18.04:LTS: protobuf, Ubuntu:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf

WID-SEC-W-2022-0607 — Red Hat FUSE: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.