What is GHSA-h4h5-3hr4-j3g2?

GHSA-h4h5-3hr4-j3g2 is a security advisory published by GitHub Security Advisories with Medium severity. protobuf-java has a potential Denial of Service issue

Which CVE IDs does GHSA-h4h5-3hr4-j3g2 cover?

GHSA-h4h5-3hr4-j3g2 covers the following CVE IDs: CVE-2022-3171. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h4h5-3hr4-j3g2?

GHSA-h4h5-3hr4-j3g2 has a CVSS v3 base score of 5.7, published by GitHub Security Advisories.

Which products are affected by GHSA-h4h5-3hr4-j3g2?

GHSA-h4h5-3hr4-j3g2 affects 20 products, including: maven/com.google.protobuf:protobuf-java:\u003e= 3.21.0-rc-1, \u003c 3.21.7; maven/com.google.protobuf:protobuf-kotlin:\u003e= 3.21.0-rc-1, \u003c 3.21.7; rubygems/google-protobuf:\u003e= 3.21.0.rc.1, \u003c 3.21.7; maven/com.google.protobuf:protobuf-javalite:\u003e= 3.21.0-rc-1, \u003c 3.21.7; maven/com.google.protobuf:protobuf-kotlin-lite:\u003e= 3.21.0-rc-1, \u003c 3.21.7; and others — see the full list on the advisory page.

GHSA-h4h5-3hr4-j3g2: protobuf-java has a pot…

🔗 CVE IDs covered (1)

CVE-2022-3171 →

📋 Description

Summary

A potential Denial of Service issue in protobuf-java core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Reporter: OSS Fuzz

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

Severity

CVE-2022-3171 Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3) protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3) google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)

🎯 Affected products20

maven/com.google.protobuf:protobuf-java:>= 3.21.0-rc-1, < 3.21.7
maven/com.google.protobuf:protobuf-kotlin:>= 3.21.0-rc-1, < 3.21.7
rubygems/google-protobuf:>= 3.21.0.rc.1, < 3.21.7
maven/com.google.protobuf:protobuf-javalite:>= 3.21.0-rc-1, < 3.21.7
maven/com.google.protobuf:protobuf-kotlin-lite:>= 3.21.0-rc-1, < 3.21.7
maven/com.google.protobuf:protobuf-java:>= 3.20.0-rc-1, < 3.20.3
maven/com.google.protobuf:protobuf-java:>= 3.17.0-rc-1, < 3.19.6
maven/com.google.protobuf:protobuf-java:< 3.16.3
maven/com.google.protobuf:protobuf-kotlin:>= 3.20.0-rc-1, < 3.20.3
maven/com.google.protobuf:protobuf-kotlin:>= 3.17.0-rc-1, < 3.19.6
maven/com.google.protobuf:protobuf-kotlin:< 3.16.3
rubygems/google-protobuf:>= 3.20.0.rc.1, < 3.20.3
rubygems/google-protobuf:>= 3.17.0.rc.1, < 3.19.6
rubygems/google-protobuf:< 3.16.3
maven/com.google.protobuf:protobuf-javalite:>= 3.20.0-rc-1, < 3.20.3
maven/com.google.protobuf:protobuf-javalite:>= 3.17.0-rc-1, < 3.19.6
maven/com.google.protobuf:protobuf-javalite:< 3.16.3
maven/com.google.protobuf:protobuf-kotlin-lite:>= 3.20.0-rc-1, < 3.20.3
maven/com.google.protobuf:protobuf-kotlin-lite:>= 3.17.0-rc-1, < 3.19.6
maven/com.google.protobuf:protobuf-kotlin-lite:< 3.16.3