RubyGems/google-protobuf CVE-2022-3171: medium 5.7, EPSS 1.28%
protobuf-java has a potential Denial of Service issue
Action: Upgrade google-protobuf to 3.16.3 (3.16.x), 3.19.6 (3.19.x), 3.20.3 (3.20.x) or 3.21.7 (3.21.x) or later.
bundle update google-protobufAffected
| introduced | fixed | last affected |
|---|---|---|
| 3.21.0.rc.1 | 3.21.7 | - |
| 3.20.0.rc.1 | 3.20.3 | - |
| 3.17.0.rc.1 | 3.19.6 | - |
| 0 | 3.16.3 | - |
Fixed versions
| 3.21.7 | 3.20.3 | 3.19.6 | 3.16.3 |
Sources
- osv: GHSA-h4h5-3hr4-j3g2
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2
- https://nvd.nist.gov/vuln/detail/CVE-2022-3171
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771
- https://github.com/protocolbuffers/protobuf
- https://github.com/protocolbuffers/protobuf/releases/tag/v21.7
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.16.3
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.19.6
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.20.3
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2022-3171.yml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP
- https://security.gentoo.org/glsa/202301-09
CVE-2022-3171 · published · modified · JSON