PyPI/nanopb CVE-2021-21401: unknown, EPSS 1.81%
Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` cal
Action: Upgrade nanopb to 0.3.9.8 or later.
pip install nanopb==0.3.9.8pip install nanopb==0.4.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.3.9.8 | - |
| 0.4.0 | 0.4.5 | - |
Fixed versions
| 0.3.9.8 | 0.4.5 |
Sources
- osv: PYSEC-2021-432
- https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88
- https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261
- https://github.com/nanopb/nanopb/issues/647
- https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1
CVE-2021-21401 · published · modified · JSON