Uncontrolled Recursion in protobuf - CVE-2024-7254

Vulnerability identifier: #VU97574

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-7254

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields. A remote attacker can pass specially crafted input to the application to create unbounded recursions and perform a denial of service (DoS) attack.

protobuf
Astronomer with IBM
Operations Analytics - Log Analysis
Oracle Utilities Network Management System
akka
DB2 Data Management Console
Guardium Data Security Center (GDSC)
Cloudera Observability with IBM
IBM Watson Machine Learning Accelerator
Knowledge Catalog Premium Cartridge
Data Product Hub
Cognos Dashboards on Cloud Pak for Data
DB2 Data Management Console on CPD
Oracle Business Intelligence Enterprise Edition
Db2 Big SQL
Maximo Application Suite - Visual Inspection Component
IBM OpenPages with Watson
IBM Business Automation Manager Open Editions
Maximo Application Suite - Predict Component
Oracle Communications User Data Repository
Business Automation Insights
PowerVM NovaLink
User Entity Behavior Analytics
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Storage Protect Server
Maximo Application Suite - Monitor Component
Telco Service Activator
Robotic Process Automation for Cloud Pak
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Public Cloud Module
Python 3 Module
Basesystem Module
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
openEuler
Netcool Operations Insight
Oracle Communications Converged Charging System
IBM SPSS Analytic Server
Crucible Data Center
Crucible Server
IBM Watson Knowledge Catalog in Cloud Pak for Data
Jira Service Management Data Center
Jira Service Management Server
IBM Tivoli Netcool Impact
Oracle Communications Unified Inventory Management
Bitbucket Data Center
Jira Software Data Center
Bamboo Server
IBM Automation Decision Services
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
IBM Cloud Pak for Security
IBM Process Mining
Red Hat build of Quarkus
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Spectrum Control
IBM Sterling B2B Integrator
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite
IBM TXSeries for Multiplatforms
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Business Automation Workflow
IBM Observability with Instana
sbt
Red Hat Camel for Spring Boot
IBM CICS TX Advanced
IBM CICS TX Standard
IBM App Connect Enterprise
error-prone
watsonx.data
IBM Cloud Pak System
IBM Edge Application Manager
Communications Unified Assurance
Communications Service Catalog and Design
IBM Qradar SIEM
Jira Software Server
IBM Cognos Controller
Bitbucket Server
Primavera Gateway
IBM WebSphere Application Server Liberty
MySQL Connectors
Splunk Enterprise
Oracle Fusion Middleware MapViewer
Oracle Banking Origination
Oracle GoldenGate Big Data and Application Adapters
IBM DB2
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Planning Analytics Local
protobuf (Ubuntu package)
libprotobuf-java (Ubuntu package)
python311-protobuf
protobuf
protobuf-javadoc
protobuf-java
protobuf-java-util
protobuf-bom
protobuf-compiler
protobuf-debuginfo
protobuf-debugsource
protobuf-devel
protobuf-lite
protobuf-lite-devel
protobuf-javalite
protobuf-parent
python3-protobuf
protobuf-devel-debuginfo
libprotobuf-lite25_1_0
libprotoc25_1_0
libprotobuf25_1_0-debuginfo
libprotoc25_1_0-debuginfo
libprotobuf25_1_0
libprotobuf-lite25_1_0-32bit
libprotobuf25_1_0-64bit
libprotobuf-lite25_1_0-64bit
libprotoc25_1_0-64bit-debuginfo
libprotobuf-lite25_1_0-64bit-debuginfo
libprotoc25_1_0-64bit
libprotobuf25_1_0-64bit-debuginfo
libprotobuf-lite25_1_0-32bit-debuginfo
libprotobuf25_1_0-32bit-debuginfo
libprotobuf25_1_0-32bit
libprotoc25_1_0-32bit-debuginfo
libprotoc25_1_0-32bit
libprotobuf-lite25_1_0-debuginfo
Dell EMC VxRail Appliance

Install updates from vendor's website.

protobuf - addressed in versions 3.25.5, 3.27.5, 3.28.2, 4.25.5, 5.27.5, 5.28.2, 25.5, 27.5, 28.2
Astronomer with IBM - update to 1.0.1
Operations Analytics - Log Analysis - update to 1.3.8.0
Netcool Operations Insight - update to 1.6.15
sbt - update to 1.10.3
error-prone - update to 2.33.0
watsonx.data - update to 2.1
IBM Cloud Pak System - update to 2.3.6.0
akka - update to 2.9.6
DB2 Data Management Console - update to 3.1.13
Guardium Data Security Center (GDSC) - update to 3.6.1
Crucible Data Center - update to 4.9.12
Crucible Server - update to 4.9.12
IBM Watson Machine Learning Accelerator - update to 5.0.3
Knowledge Catalog Premium Cartridge - update to 5.2
Data Product Hub - update to 5.1.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 5.2
Cognos Dashboards on Cloud Pak for Data - update to 5.3
DB2 Data Management Console on CPD - update to 5.1.2
Jira Service Management Data Center - addressed in versions 5.12.14, 5.17.4, 10.1.1
Jira Service Management Server - addressed in versions 5.12.14, 5.17.4, 10.1.1
IBM Tivoli Netcool Impact - update to 7.1.0.37
Db2 Big SQL - update to 8.0
Maximo Application Suite - Visual Inspection Component - update to 8.9.20
Bitbucket Data Center - update to 8.19.25
Bitbucket Server - update to 8.19.25
Jira Software Server - addressed in versions 9.4.28, 9.12.15, 9.17.4, 10.1.2
IBM Business Automation Manager Open Editions - update to 9.1.1
Jira Software Data Center - addressed in versions 9.4.28, 9.12.15, 9.17.4, 10.1.2
Maximo Application Suite - Predict Component - update to 9.0.3
Splunk Enterprise - addressed in versions 9.2.8, 9.3.6, 9.4.4, 10.0.1
Bamboo Server - addressed in versions 9.6.7, 10.0.2
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
IBM Automation Decision Services - update to 24.0.0.0.4
IBM Cloud Pak for Security - update to 1.11.2.0
IBM Process Mining - update to 1.15.0 IF003
Planning Analytics Local - addressed in versions 2.0.0.101, 2.0.9.21, 2.1.8
PowerVM NovaLink - addressed in versions 2.1.1-250103, 2.2.1.1-250103, 2.3.0-250103
protobuf (Ubuntu package) - addressed in versions 2.6.1-1.3ubuntu0.1~esm4, 3.0.0-9.1ubuntu1.1+esm3, 3.6.1.3-2ubuntu5.2+esm2, 3.12.4-1ubuntu7.22.04.4, 3.21.12-8.2ubuntu0.2, 3.21.12-10ubuntu0.1
Red Hat build of Quarkus - addressed in versions 3.2.12.SP1, 3.8.6.SP1
libprotobuf-java (Ubuntu package) - addressed in versions 3.12.4-1ubuntu7.22.04.2, 3.21.12-8.2ubuntu0.1, 3.21.12-9ubuntu1.1
Red Hat Camel for Spring Boot - update to 4.4.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.7, 5.1.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.8.8
python311-protobuf - addressed in versions 4.25.1-150400.9.10.1, 4.25.1-150500.12.5.1, 4.25.1-150600.16.7.1
User Entity Behavior Analytics - update to 5.0.2
App Connect Enterprise Certified Container - addressed in versions 5.0.22, 12.0.6, 12.5.1
watsonx Assistant Cartridge - update to 5.1.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
IBM Spectrum Control - update to 5.4.13
IBM Sterling B2B Integrator - update to 6.2.0.4
Dell EMC VxRail Appliance - update to 8.0.311
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.17
Storage Protect Server - update to 8.1.27.100
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.18
IBM Maximo Application Suite - addressed in versions 8.10.19, 8.11.16, 9.0.4
Maximo Application Suite - Monitor Component - update to 9.1.0
IBM TXSeries for Multiplatforms - addressed in versions 9.1.0.3, 10.1.0.0
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix35, 11.1.0.0 ifix27
Telco Service Activator - update to 10.1.1
IBM Cognos Controller - addressed in versions 11.0.1.4, 11.1.0.2
IBM CICS TX Standard - update to 11.1.0.0 ifix28
IBM DB2 - addressed in versions 11.1.4 FP7, 11.5.9, 12.1.1
IBM App Connect Enterprise - addressed in versions 12.0.12.7, 13.0.1.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.20, 23.0.20
IBM Robotic Process Automation - addressed in versions 21.0.7.20, 23.0.20
IBM Business Automation Workflow - addressed in versions 24.0.0-IF004, 24.0.1-IF001
IBM WebSphere Application Server Liberty - update to 24.0.0.11
protobuf - update to 25.1-7
protobuf-javadoc - update to 25.1-7
protobuf-java - update to 25.1-7
protobuf-java-util - update to 25.1-7
protobuf-bom - update to 25.1-7
protobuf-compiler - update to 25.1-7
protobuf-debuginfo - update to 25.1-7
protobuf-debugsource - update to 25.1-7
protobuf-devel - update to 25.1-7
protobuf-lite - update to 25.1-7
protobuf-lite-devel - update to 25.1-7
protobuf-javalite - update to 25.1-7
protobuf-parent - update to 25.1-7
python3-protobuf - update to 25.1-7
protobuf-debugsource - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
protobuf-devel-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf-lite25_1_0 - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
protobuf-devel - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotoc25_1_0 - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf25_1_0-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotoc25_1_0-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf25_1_0 - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
protobuf-java - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf-lite25_1_0-32bit - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf25_1_0-64bit - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf-lite25_1_0-64bit - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotoc25_1_0-64bit-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf-lite25_1_0-64bit-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotoc25_1_0-64bit - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf25_1_0-64bit-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf-lite25_1_0-32bit-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf25_1_0-32bit-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf25_1_0-32bit - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotoc25_1_0-32bit-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotoc25_1_0-32bit - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
libprotobuf-lite25_1_0-debuginfo - addressed in versions 25.1-150400.9.10.1, 25.1-150500.12.5.1, 25.1-150600.16.7.1
IBM Observability with Instana - update to 287

• https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa

• Denial of service in Google protobuf
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
• akka update for protobuf
• error-prone update for protobuf
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Red Hat build of Quarkus 3.8.6
• Multiple vulnerabilities in Red Hat build of Quarkus 3.2.12
• Jira Service Management Data Center and Server update for protobuf
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• IBM WebSphere Application Server Liberty update for Google Protocol Buffers
• sbt update for protobuf
• SUSE update for protobuf
• SUSE update for protobuf
• SUSE update for protobuf
• IBM Watson Discovery update for Google Protocol Buffers
• IBM App Connect Enterprise update for Google Protocol Buffers
• Multiple vulnerabilities in IBM Maximo Application Suite
• IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands update for Google Protocol Buffers (a.k.a., protobuf)
• Multiple vulnerabilities in IBM Data Product Hub
• Uncontrolled Recursion in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• IBM PowerVM Novalink update for Protocol Buffers
• IBM QRadar SIEM update for Protocol Buffers
• IBM Spectrum Control update for Protocol Buffers
• Multiple vulnerabilities in Dell VxRail Appliance
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• IBM Robotic Process Automation update for Google Protocol Buffers
• IBM Maximo Application Suite - Predict Component update for Protocol Buffers
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in IBM SPSS Analytic Server
• IBM Sterling B2B Integrator update for Protocol Buffers
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM Watson Assistant for IBM Cloud Pak for Data update for Protocol Buffers
• IBM watsonx.data update for protobuf-java
• IBM Maximo Application Suite - Monitor Component update for Protocol Buffers
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Bamboo Data Center and Server update for protobuf
• Jira Software Data Center and Server update for protobuf-java
• openEuler 24.03 LTS update for protobuf
• Multiple vulnerabilities in IBM Cloud Application Performance Management (APM)
• IBM Business Automation Workflow update for Protocol Buffers
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Planning Analytics
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component update for StackOverflow
• IBM CICS TX Advanced update for Google Protocol Buffers
• IBM CICS TX Standard update for Google Protocol Buffers
• Ubuntu update for protobuf
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Primavera Gateway
• Multiple vulnerabilities in Oracle Communications User Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Fusion Middleware MapViewer
• Multiple vulnerabilities in MySQL Connectors
• Multiple vulnerabilities in IBM Cloud Pak for Security
• IBM Db2 update for Protocol Buffers
• Multiple vulnerabilities in HPE Telco Service Activator
• Ubuntu update for protobuf
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Data Analytics Function
• Multiple vulnerabilities in IBM OpenPages
• IBM DB2 Data Management Console update for Protocol Buffers
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in Astronomer with IBM
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Cloudera Observability on Premises with IBM
• Ubuntu update for protobuf
• Splunk Enterprise Security update for third-party components
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in Oracle Communications Converged Charging System
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Bitbucket Data Center and Server update for protobuf-java
• Multiple vulnerabilities in Oracle Utilities Network Management System
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge
• Multiple vulnerabilities in Oracle GoldenGate Big Data and Application Adapters
• Multiple vulnerabilities in IBM Watson Knowledge Catalog on-prem
• Multiple vulnerabilities in Crucible Data Center and Crucible Server