Most recent entries from all

ALSA-2022:7464 — Moderate: protobuf security update

Affected: AlmaLinux:8: protobuf, AlmaLinux:8: protobuf-compiler, AlmaLinux:8: protobuf-devel, AlmaLinux:8: protobuf-lite, AlmaLinux:8: protobuf-lite-devel, AlmaLinux:8: python3-protobuf

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.

Security Fix(es):

* protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference (CVE-2021-22570)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-03824

Withdrawn: BELL-CVE-2021-22570 — CVE-2021-22570 does not affect BellSoft software

Withdrawn by the publisher.

BREW-duplicity-CVE-2021-22570

Affected: Homebrew: duplicity

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

certfr-2023-avi-0956 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Elles permettent…

certfr-2023-avi-0956

CLEANSTART-2026-GA54121 — Security fix for CVE-2021-22570 applied in: apache-hive 4.0.0-r0, apache-hive 4.2.0-r0, spark-sc213-jdk17-py312 3.4.4-r…

Affected: CleanStart: apache-hive, CleanStart: spark-sc213-jdk17-py312

CVE-2021-22570 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-232103

fkie_cve-2021-22570

Withdrawn: GHSA-77rm-9x9h-xj3g — Withdrawn Advisory: NULL Pointer Dereference in Protocol Buffers

Withdrawn by the publisher.

Affected: NuGet: Google.Protobuf, Packagist: google/protobuf, Maven: com.google.protobuf:protobuf-java, Go: github.com/protocolbuffers/protobuf, PyPI: protobuf

### Withdrawn Advisory

This advisory has been withdrawn because the protobuf vulnerability comes from the compiler rather that the code. This link is maintained to preserve external references.

### Original Description

gsd-2021-22570

msrc_CVE-2021-22570 — Nullptr Dereference in Protobuf

msrc_CVE-2021-22570

OESA-2022-2106 — protobuf security update

Affected: openEuler:20.03-LTS-SP1: protobuf

Protocol Buffers (a.k.a., protobuf) are Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data. You can find protobuf's documentation on the Google Developers site. Security Fix(es): Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.(CVE-2021-22570)

openSUSE-SU-2022:0823-1 — Security update for protobuf

Security update for protobuf

PYSEC-2022-48

Affected: PyPI: protobuf

RHSA-2022:8847 — Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (protobuf) security update

protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference

SUSE-SU-2022:1040-1 — Security update for protobuf

Security update for protobuf

UBUNTU-CVE-2021-22570

Affected: Ubuntu:Pro:14.04:LTS: protobuf, Ubuntu:Pro:16.04:LTS: protobuf, Ubuntu:18.04:LTS: protobuf, Ubuntu:20.04:LTS: protobuf, Ubuntu:22.04:LTS: protobuf

WID-SEC-W-2022-0169 — Oracle MySQL: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.