GHSA-77rm-9x9h-xj3g
Withdrawn Advisory: NULL Pointer Dereference in Protocol Buffers
Withdrawn ·
At a glance
- Published
- Updated
- CVE
- CVE-2021-22570
- Aliases
- PYSEC-2022-48
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
### Withdrawn Advisory This advisory has been withdrawn because the protobuf vulnerability comes from the compiler rather that the code. This link is maintained to preserve external references. ### Original Description Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Google.Protobuf | introduced 0, fixed 3.15.0 |
| Packagist · google/protobuf | introduced 0, fixed 3.15.0 |
| Maven · com.google.protobuf:protobuf-java | introduced 0, fixed 3.15.0 |
| Go · github.com/protocolbuffers/protobuf | introduced 0, fixed 0.0.0-20210218195015-ae50d9b99025 |
| PyPI · protobuf | introduced 0, fixed 3.15.0 |
| Go · github.com/protocolbuffers/protobuf | introduced 0.0.0, fixed 3.15.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-22570 ADVISORY
- https://github.com/advisories/GHSA-77rm-9x9h-xj3g ADVISORY
- https://github.com/protocolbuffers/protobuf PACKAGE
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0 WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/protobuf/PYSEC-2022-48.yaml WEB
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3DVUZPALAQ34TQP6KFNLM4IZS6B32XSA WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTRGBRC5KGCA4SK5MUNLPYJRAGXMBIYY WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFX6KPNOFHYD6L4XES5PCM3QNSKZBOTQ WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVTWVQRB5OCCTMKEQFY5MYED3DXDVSLP WEB
- https://security.netapp.com/advisory/ntap-20220429-0005 WEB
- https://www.oracle.com/security-alerts/cpuapr2022.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |