openEuler 22.03 LTS update for protobuf
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2021-22569 |
| CWE-ID | CWE-399 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
openEuler Operating systems & Components / Operating system protobuf-java Operating systems & Components / Operating system package or component python3-protobuf Operating systems & Components / Operating system package or component protobuf-parent Operating systems & Components / Operating system package or component protobuf-java-util Operating systems & Components / Operating system package or component protobuf-javalite Operating systems & Components / Operating system package or component protobuf-bom Operating systems & Components / Operating system package or component protobuf-javadoc Operating systems & Components / Operating system package or component protobuf-lite-devel Operating systems & Components / Operating system package or component protobuf-compiler Operating systems & Components / Operating system package or component protobuf-devel Operating systems & Components / Operating system package or component protobuf-lite Operating systems & Components / Operating system package or component protobuf-debuginfo Operating systems & Components / Operating system package or component protobuf-debugsource Operating systems & Components / Operating system package or component protobuf Operating systems & Components / Operating system package or component |
| Vendor | openEuler |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Resource management error
EUVDB-ID: #VU60181
Risk: Medium
CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2021-22569
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application. protobuf-java allowes the interleaving of
com.google.protobuf.UnknownFieldSet fields in such a way that would be
processed out of order. A small malicious payload can occupy the parser
for several minutes by creating large numbers of short-lived objects
that cause frequent, repeated pauses. A remote attacker can trick the victim into passing specially crafted data to the application and perform a denial of service attack.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
protobuf-java: before 3.14.0-4
python3-protobuf: before 3.14.0-4
protobuf-parent: before 3.14.0-4
protobuf-java-util: before 3.14.0-4
protobuf-javalite: before 3.14.0-4
protobuf-bom: before 3.14.0-4
protobuf-javadoc: before 3.14.0-4
protobuf-lite-devel: before 3.14.0-4
protobuf-compiler: before 3.14.0-4
protobuf-devel: before 3.14.0-4
protobuf-lite: before 3.14.0-4
protobuf-debuginfo: before 3.14.0-4
protobuf-debugsource: before 3.14.0-4
protobuf: before 3.14.0-4
CPE2.3- cpe:2.3:o:openeuler:openeuler:22.03:LTS:*:*:*:*:*:*
- cpe:2.3:a:openeuler:protobuf-java:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:python3-protobuf:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-parent:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-java-util:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-javalite:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-bom:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-javadoc:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-lite-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-compiler:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-lite:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:protobuf:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1694
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
