Resource management error in protobuf - CVE-2021-22569

Vulnerability identifier: #VU60181

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22569

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. protobuf-java allowes the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. A remote attacker can trick the victim into passing specially crafted data to the application and perform a denial of service attack.

protobuf
grpc-java
Cloudera Observability with IBM
DataStage on Cloud Pak for Data
Dell EMC Streaming Data Platform
Cloud Pak for Network Automation
PowerStore T
Dell EMC PowerStore Family Operating System
User Entity Behavior Analytics
IBM Observability with Instana
Netcool Operations Insight
Oracle Communications Cloud Native Core Network Repository Function
IBM Watson Knowledge Catalog in Cloud Pak for Data
Crucible Data Center
Crucible Server
Jira Service Management Server
Jira Service Management Data Center
Oracle Communications Unified Inventory Management
Log Analysis
Integration Debezium
Red Hat Integration - Service Registry
QRadar User Behavior Analytics
App Connect Enterprise Certified Container
IBM Cloud Application Performance Management (APM)
IBM Security Verify Governance
IBM Qradar SIEM
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Ubuntu
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
Public Cloud Module
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Installer
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Module for Public Cloud
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
openEuler
tink
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Policy
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Cloudera Data Platform Private Cloud Base for IBM
Splunk Enterprise
IBM Security Guardium
Oracle WebLogic Server
SUSE Linux Enterprise Module for Packagehub Subpackages
libprotoc8 (Ubuntu package)
libprotobuf8 (Ubuntu package)
libprotobuf-lite8 (Ubuntu package)
protobuf-compiler (Ubuntu package)
python3-opencensus-ext-threading
python3-opencensus-context
python3-grpcio-gcp
python3-aiocontextvars
python2-grpcio-gcp
python3-Automat
python3-opencensus
python3-pytest-asyncio
python3-knack
python3-Deprecated
python3-jsondiff
python2-jsondiff
python3-websocket-client
python3-opentelemetry-api
python2-googleapis-common-protos
python3-googleapis-common-protos
python3-avro
python3-google-api-core
grpc-debuginfo
libgrpc++1
libgrpc8
python3-grpcio
grpc-devel
grpc-source
python2-grpcio
python2-grpcio-debuginfo
libgrpc8-debuginfo
grpc-devel-debuginfo
python3-grpcio-debuginfo
libgrpc++1-debuginfo
grpc-debugsource
python3-PyGithub
azure-cli-core
python2-requests
python3-requests
python3-protobuf (Ubuntu package)
libprotobuf10 (Ubuntu package)
python-protobuf (Ubuntu package)
libprotobuf-lite10 (Ubuntu package)
libprotoc10 (Ubuntu package)
python3-cryptography-vectors
python2-cryptography-vectors
python-cryptography-debugsource
python3-cryptography-debuginfo
python2-cryptography
python-cryptography-debuginfo
python2-cryptography-debuginfo
python3-cryptography
libprotoc17 (Ubuntu package)
libprotoc-dev (Ubuntu package)
libprotobuf-lite17 (Ubuntu package)
protobuf-devel-debuginfo
libprotobuf-lite20-debuginfo
protobuf-devel
libprotobuf20-debuginfo
libprotoc20-debuginfo
libprotobuf-lite20
libprotobuf20
python2-protobuf
protobuf-java
libprotobuf20-32bit
libprotoc20
libprotobuf-lite20-32bit
libprotoc20-32bit
python3-protobuf
protobuf-debugsource
protobuf-source
libprotobuf-lite20-32bit-debuginfo
libprotoc20-32bit-debuginfo
libprotobuf20-32bit-debuginfo
python3-pytest
libprotobuf-java (Ubuntu package)
libprotobuf-lite23 (Ubuntu package)
libprotobuf23 (Ubuntu package)
libprotoc23 (Ubuntu package)
protobuf-parent
protobuf
protobuf-debuginfo
protobuf-lite
protobuf-compiler
protobuf-lite-devel
protobuf-javadoc
protobuf-bom
protobuf-javalite
protobuf-java-util
python3-zope.interface
python-zope.interface-debugsource
python-zope.interface-debuginfo
python3-zope.interface-debuginfo
python3-psutil
python-psutil-debuginfo
python2-psutil-debuginfo
python2-psutil
python3-psutil-debuginfo
python-psutil-debugsource
python3-websockets-debuginfo
python-websockets-debugsource
python3-websockets
python2-humanfriendly
python3-humanfriendly
python3-constantly
python3-hyperlink
python3-incremental
python3-Twisted
python3-Twisted-debuginfo
Oracle Database Server
IBM Disconnected Log Collector
IBM Tivoli Network Manager (ITNM)
watsonx.data
Dell EMC VxRail Appliance
IBM App Connect Enterprise
IBM Cognos Analytics

Install updates from vendor's website.

protobuf - update to 3.19.2
tink - update to 1.7.0
Netcool Operations Insight - update to 1.6.15
grpc-java - addressed in versions 1.41.2, 1.42.2, 1.43.2
DataStage on Cloud Pak for Data - update to 4.8.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
Crucible Data Center - update to 4.9.12
Crucible Server - update to 4.9.12
Jira Service Management Server - addressed in versions 4.20.27, 5.4.11
Jira Service Management Data Center - addressed in versions 4.20.27, 5.4.11
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.0
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
libprotoc8 (Ubuntu package) - update to Ubuntu Pro
libprotobuf8 (Ubuntu package) - update to Ubuntu Pro
libprotobuf-lite8 (Ubuntu package) - update to Ubuntu Pro
protobuf-compiler (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5.2, 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
python3-opencensus-ext-threading - update to 0.1.2-150100.3.3.3
python3-opencensus-context - update to 0.1.2-150100.3.3.3
python3-grpcio-gcp - update to 0.2.2-150100.3.3.3
python3-aiocontextvars - update to 0.2.2-150100.3.3.3
python2-grpcio-gcp - update to 0.2.2-150100.3.3.3
python3-Automat - update to 0.6.0-150000.3.4.1
python3-opencensus - update to 0.8.0-150100.3.3.3
python3-pytest-asyncio - update to 0.8.0-150100.3.3.3
python3-knack - update to 0.9.0-150100.3.7.3
python3-Deprecated - update to 1.2.13-150100.3.3.3
python3-jsondiff - update to 1.3.0-150100.3.6.3
python2-jsondiff - update to 1.3.0-150100.3.6.3
python3-websocket-client - update to 1.3.2-150100.6.7.3
Log Analysis - update to 1.3.7.2 IF001
python3-opentelemetry-api - update to 1.5.0-150100.3.3.3
python2-googleapis-common-protos - update to 1.6.0-150100.3.3.3
python3-googleapis-common-protos - update to 1.6.0-150100.3.3.3
Dell EMC Streaming Data Platform - update to 1.7.0
IBM Disconnected Log Collector - update to 1.8.3
Integration Debezium - update to 1.9.7
python3-avro - update to 1.11.0-150100.3.3.3
python3-google-api-core - update to 1.14.2-150100.3.3.3
grpc-debuginfo - update to 1.25.0-150100.3.3.3
libgrpc++1 - update to 1.25.0-150100.3.3.3
libgrpc8 - update to 1.25.0-150100.3.3.3
python3-grpcio - update to 1.25.0-150100.3.3.3
grpc-devel - update to 1.25.0-150100.3.3.3
grpc-source - update to 1.25.0-150100.3.3.3
python2-grpcio - update to 1.25.0-150100.3.3.3
python2-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
libgrpc8-debuginfo - update to 1.25.0-150100.3.3.3
grpc-devel-debuginfo - update to 1.25.0-150100.3.3.3
python3-grpcio-debuginfo - update to 1.25.0-150100.3.3.3
libgrpc++1-debuginfo - update to 1.25.0-150100.3.3.3
grpc-debugsource - update to 1.25.0-150100.3.3.3
python3-PyGithub - update to 1.43.5-150100.3.3.3
watsonx.data - update to 2.0.3
Red Hat Integration - Service Registry - update to 2.3.0
Cloud Pak for Network Automation - update to 2.6.0
azure-cli-core - update to 2.17.1-150100.6.18.1
python2-requests - update to 2.25.1-150100.6.13.3
python3-requests - update to 2.25.1-150100.6.13.3
python3-protobuf (Ubuntu package) - addressed in versions 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5.2, 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotobuf10 (Ubuntu package) - update to 3.0.0-9.1ubuntu1.1
python-protobuf (Ubuntu package) - addressed in versions 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5.2
libprotobuf-lite10 (Ubuntu package) - update to 3.0.0-9.1ubuntu1.1
libprotoc10 (Ubuntu package) - update to 3.0.0-9.1ubuntu1.1
python3-cryptography-vectors - update to 3.3.2-150100.3.11.3
python2-cryptography-vectors - update to 3.3.2-150100.3.11.3
python-cryptography-debugsource - update to 3.3.2-150100.7.15.3
python3-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
python2-cryptography - update to 3.3.2-150100.7.15.3
python-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
python2-cryptography-debuginfo - update to 3.3.2-150100.7.15.3
python3-cryptography - update to 3.3.2-150100.7.15.3
PowerStore T - update to 3.5.0.1-2083289
libprotoc17 (Ubuntu package) - update to 3.6.1.3-2ubuntu5.2
libprotoc-dev (Ubuntu package) - update to 3.6.1.3-2ubuntu5.2
libprotobuf-lite17 (Ubuntu package) - update to 3.6.1.3-2ubuntu5.2
protobuf-devel-debuginfo - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf-lite20-debuginfo - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
protobuf-devel - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf20-debuginfo - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotoc20-debuginfo - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf-lite20 - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf20 - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
python2-protobuf - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
protobuf-java - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf20-32bit - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotoc20 - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf-lite20-32bit - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotoc20-32bit - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
python3-protobuf - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
protobuf-debugsource - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
protobuf-source - addressed in versions 3.9.2-150100.8.3.3, 3.9.2-150200.4.19.2
libprotobuf-lite20-32bit-debuginfo - update to 3.9.2-150200.4.19.2
libprotoc20-32bit-debuginfo - update to 3.9.2-150200.4.19.2
libprotobuf20-32bit-debuginfo - update to 3.9.2-150200.4.19.2
python3-pytest - update to 3.10.1-150000.7.5.1
libprotobuf-java (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotobuf-lite23 (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotobuf23 (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
libprotoc23 (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.1, 3.12.4-1ubuntu7.22.10.1
protobuf-parent - update to 3.14.0-4
protobuf - update to 3.14.0-4
protobuf-debugsource - update to 3.14.0-4
protobuf-debuginfo - update to 3.14.0-4
protobuf-lite - update to 3.14.0-4
protobuf-devel - update to 3.14.0-4
protobuf-compiler - update to 3.14.0-4
protobuf-lite-devel - update to 3.14.0-4
protobuf-javadoc - update to 3.14.0-4
protobuf-bom - update to 3.14.0-4
protobuf-javalite - update to 3.14.0-4
protobuf-java-util - update to 3.14.0-4
python3-protobuf - update to 3.14.0-4
protobuf-java - update to 3.14.0-4
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
QRadar User Behavior Analytics - update to 4.1.9
IBM Tivoli Network Manager (ITNM) - update to 4.2.0.16
python3-zope.interface - update to 4.4.2-150000.3.4.1
python-zope.interface-debugsource - update to 4.4.2-150000.3.4.1
python-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
python3-zope.interface-debuginfo - update to 4.4.2-150000.3.4.1
User Entity Behavior Analytics - update to 5.0.2
App Connect Enterprise Certified Container - addressed in versions 5.0.6, 8.1.0
python3-psutil - update to 5.9.1-150100.6.6.3
python-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python2-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python2-psutil - update to 5.9.1-150100.6.6.3
python3-psutil-debuginfo - update to 5.9.1-150100.6.6.3
python-psutil-debugsource - update to 5.9.1-150100.6.6.3
Dell EMC VxRail Appliance - update to 7.0.411
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
python3-websockets-debuginfo - update to 9.1-150100.3.3.3
python-websockets-debugsource - update to 9.1-150100.3.3.3
python3-websockets - update to 9.1-150100.3.3.3
IBM Security Verify Governance - update to 10.0.2
python2-humanfriendly - update to 10.0-150100.6.3.3
python3-humanfriendly - update to 10.0-150100.6.3.3
IBM App Connect Enterprise - addressed in versions 11.0.0.20, 12.0.8.0
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 7, 11.2.4.1 IF1
python3-constantly - update to 15.1.0-150000.3.4.1
python3-hyperlink - update to 17.2.1-150000.3.4.1
python3-incremental - update to 17.5.0-150000.3.4.1
python3-Twisted - update to 17.9.0-150000.3.8.1
python3-Twisted-debuginfo - update to 17.9.0-150000.3.8.1

• Exploit #7348 - A-potential-Denial-of-Service-issue-in-protobuf-java (A potential Denial of Service issue in protobuf-java high severity GitHub Reviewed Published 5 days ago in protocolbuffers/protobuf • Updated yesterday Vulnerability details Dependabot alerts 2 Package (February 13, 2022)

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
• https://cloud.google.com/support/bulletins#gcp-2022-001
• http://www.openwall.com/lists/oss-security/2022/01/12/4
• http://www.openwall.com/lists/oss-security/2022/01/12/7

• Denial of service in Google protobuf
• Denial of service in grpc-java
• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in tink
• Multiple vulnerabilities in Red Hat Integration - Service registry
• Denial of service in IBM Operations Analytics
• Multiple vulnerabilities in Red Hat Integration Debezium
• SUSE update for protobuf
• Multiple vulnerabilities in IBM Tivoli Network Manager (ITNM)
• Ubuntu update for protobuf
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Oracle WebLogic Server
• IBM App Connect Enterprise Certified Container update for protobuf
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM App Connect Enterprise
• Resource management error in IBM QRadar SIEM
• SUSE update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Dell Streaming Data Platform
• Multiple vulnerabilities in Dell PowerStore Family
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• SUSE update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, pyt
• Jira Service Management Data Center and Server update for protobuf-java
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Application Performance Management
• openEuler 22.03 LTS update for protobuf
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Dell PowerStore Family
• IBM watsonx.data update for Google Protocol Buffers
• IBM watsonx.data update for FasterXML jackson-databind
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in IBM Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Crucible Data Center and Crucible Server