tocsin

CVE-2021-21401

2 advisories.

PyPI/nanopb CVE-2021-21401: high 7.1, EPSS 1.81%

nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC

Action: Upgrade nanopb to 0.3.9.8 or later.

pip install nanopb==0.3.9.8
pip install nanopb==0.4.5

Affected

introducedfixedlast affected
0.3.20.3.9.8-
0.4.00.4.5-

Fixed versions

0.3.9.80.4.5

Sources

CVE-2021-21401 · published · modified · JSON

PyPI/nanopb CVE-2021-21401: unknown, EPSS 1.81%

Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` cal

Action: Upgrade nanopb to 0.3.9.8 or later.

pip install nanopb==0.3.9.8
pip install nanopb==0.4.5

Affected

introducedfixedlast affected
00.3.9.8-
0.4.00.4.5-

Fixed versions

0.3.9.80.4.5

Sources

CVE-2021-21401 · published · modified · JSON