CVE-2022-3171: Memory handling vulnerability in ProtocolBuffers Java core and lite
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Other sources
A potential Denial of Service issue in protobuf-java core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.
— Red Hat
Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. An attacker could exploit this vulnerability using a method call to obtain sensitive information.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-3171.
What is the severity level of CVE-2022-3171?
CVE-2022-3171 has a severity level of high.
How can this vulnerability be exploited?
This vulnerability can be exploited through malicious inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields.
What is the affected software and versions?
The affected software is protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3.
What is the recommended remedy for this vulnerability?
To mitigate this vulnerability, update the protobuf-java package to version 3.21.7, 3.20.3, 3.19.6, or 3.16.3.