CVE-2021-22569: Denial of Service of protobuf-java parsing procedure
A flaw was found in protobuf-java. Google Protocol Buffer (protobuf-java) allows the interleaving of com.google.protobuf.UnknownFieldSet fields. By persuading a victim to open specially-crafted content, a remote attacker could cause a timeout in the ProtobufFuzzer function, resulting in a denial of service.
Other sources
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
Denial of Service of protobuf-java parsing procedure
— Microsoft
Google Protocol Buffer (protobuf-java) is vulnerable to a denial of service, caused by an issue with allow interleaving of com.google.protobuf.UnknownFieldSet fields. By persuading a victim to open a specially-crafted content, a remote attacker could exploit this vulnerability to cause a timeout in ProtobufFuzzer function, and results in a denial of service condition.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-22569.
What is the severity of CVE-2021-22569?
The severity of CVE-2021-22569 is medium with a severity value of 5.5.
What is the affected software of CVE-2021-22569?
The affected software of CVE-2021-22569 is Google Protocol Buffer (protobuf-java) versions 3.16.1, 3.18.2, and 3.19.2, as well as IBM Disconnected Log Collector versions v1.0 to v1.8.2.
How can the vulnerability CVE-2021-22569 be exploited?
The vulnerability CVE-2021-22569 can be exploited by persuading a victim to open a specially-crafted content, causing a timeout.
Is there a fix available for CVE-2021-22569?
Yes, there are fixes available for CVE-2021-22569. For Google Protocol Buffer (protobuf-java), the recommended fix is to upgrade to version 3.16.1, 3.18.2, or 3.19.2. For IBM Disconnected Log Collector, the recommended fix is to upgrade to a version higher than v1.8.2.