PyPI/nanopb CVE-2021-21401: high 7.1, EPSS 1.81%
nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC
Action: Upgrade nanopb to 0.3.9.8 or later.
pip install nanopb==0.3.9.8pip install nanopb==0.4.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.3.2 | 0.3.9.8 | - |
| 0.4.0 | 0.4.5 | - |
Fixed versions
| 0.3.9.8 | 0.4.5 |
Sources
- osv: GHSA-7mv5-5mxh-qg88
- https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88
- https://nvd.nist.gov/vuln/detail/CVE-2021-21401
- https://github.com/nanopb/nanopb/issues/647
- https://github.com/nanopb/nanopb/commit/4a375a560651a86726e5283be85a9231fd0efe9c
- https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261
- https://github.com/nanopb/nanopb
- https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1
- https://github.com/pypa/advisory-database/tree/main/vulns/nanopb/PYSEC-2021-432.yaml
CVE-2021-21401 · published · modified · JSON