Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Mageia 8: MGASA-2023-0092 Moderate: Protobuf Denial Of Service

mageia
Calendar Grey March 18, 2023
Dist Mageia Esm H88
Enhanced protobuf libraries in Mageia address severe decoding flaws that could enable service disruption.
Parsing vulnerability for the MessageSet type in the ProtocolBuffers for protobuf-python can lead to out of memory can lead to a Denial of Service against services receiving unsani...

Summary

Parsing vulnerability for the MessageSet type in the ProtocolBuffers for protobuf-python can lead to out of memory can lead to a Denial of Service against services receiving unsanitized input. (CVE-2022-1941) A parsing issue with binary data in protobuf-java core and lite can lead to a denial of service attack with crafted input. (CVE-2022-3171)

References

- https://bugs.mageia.org/show_bug.cgi?id=30906

- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf

- https://lists.suse.com/pipermail/sle-security-updates/2022-November/012857.html

- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2

-

- https://ubuntu.com/security/notices/USN-5769-1

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3/

- https://ubuntu.com/security/notices/USN-5945-1

- https://www.cve.org/CVERecord?id=CVE-2022-1941

- https://www.cve.org/CVERecord?id=CVE-2022-3171

Topics%20covered

Topics Covered

security advisory denial of service mageia protobuf parsing attack

Resolution

SRPMS

- 8/core/protobuf-3.14.0-1.2.mga8

Publication date: 18 Mar 2023
URL: https://advisories.mageia.org/MGASA-2023-0092.html
Type: security
CVE: CVE-2022-1941, CVE-2022-3171

Topics%20covered

Topics Covered

security advisory denial of service mageia protobuf parsing attack

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here