Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A denial-of-service (DoS) vulnerability exists in google.protobuf.jsonformat.ParseDict() in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
Recommended action: Upgrade to 6.33.5 or 5.29.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team ecosystem@trailofbits.com Affected versions: This issue only affects the pure-Python implementation of protobuf-python backend. This is the implementation when PROTOCOLBUFFERSPYTHONIMPLEMENTATION=python environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default. This is a Python variant of a previous issue affecting protobuf-java. Severity This is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker. Proof of Concept For reproduction details, please refer to the unit tests decodertest.py and…
Recommended action: Upgrade to 6.31.1, 5.29.5 or 4.25.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries. Reporter: ClusterFuzz Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below. Severity & Impact As scored by google Medium 5.7 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Asscored byt NIST High 7.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM. Proof of Concept For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness. Mitigation / Patching Please update to the latest available versions of the following packages: - protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) -…
Recommended action: Upgrade to 4.21.6, 3.20.2, 3.19.5 or 3.18.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
Recommended action: Upgrade to 3.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Recommended action: Upgrade to 3.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.