CVE-2022-1941

CVSS V2 None CVSS V3 High 7.5
Description
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
Overview
  • CVE ID
  • CVE-2022-1941
  • Assigner
  • cve-coordination@google.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2022-09-22T15:15:09
  • Last Modified Date
  • 2023-04-27T03:15:08
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CWE-1286 http://cwe.mitre.org/data/definitions/1286.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:google:protobuf-cpp:*:*:*:*:*:*:*:* 1 OR 3.18.3
cpe:2.3:a:google:protobuf-cpp:*:*:*:*:*:*:*:* 1 OR 3.19.0 3.19.5
cpe:2.3:a:google:protobuf-cpp:*:*:*:*:*:*:*:* 1 OR 3.20.0 3.20.2
cpe:2.3:a:google:protobuf-cpp:*:*:*:*:*:*:*:* 1 OR 3.21.0 3.21.6
cpe:2.3:a:google:protobuf-python:*:*:*:*:*:*:*:* 1 OR 3.18.3
cpe:2.3:a:google:protobuf-python:*:*:*:*:*:*:*:* 1 OR 3.19.0 3.19.5
cpe:2.3:a:google:protobuf-python:*:*:*:*:*:*:*:* 1 OR 3.20.0 3.20.2
cpe:2.3:a:google:protobuf-python:*:*:*:*:*:*:*:* 1 OR 4.0.0 4.21.6
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • NONE
  • Availability Impact
  • HIGH
  • Base Score
  • 7.5
  • Base Severity
  • HIGH
  • Exploitability Score
  • 3.9
  • Impact Score
  • 3.6
References
Reference URL Reference Tags
http://www.openwall.com/lists/oss-security/2022/09/27/1 Mailing List Third Party Advisory
https://cloud.google.com/support/bulletins#GCP-2022-019 Third Party Advisory
https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP/
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-1941
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1941
History
Created Old Value New Value Data Type Notes
2022-09-22 16:00:20 Added to TrackCVE
2022-12-07 04:28:20 security@google.com cve-coordination@google.com CVE Assigner updated
2022-12-07 04:28:21 2022-09-22T15:15Z 2022-09-22T15:15:09 CVE Published Date updated
2022-12-07 04:28:21 2022-10-01T02:27:54 CVE Modified Date updated
2022-12-07 04:28:21 Analyzed Vulnerability Status updated
2022-12-07 04:28:26 References updated
2022-12-18 09:23:43 2022-12-18T04:15:08 CVE Modified Date updated
2022-12-18 09:23:43 Analyzed Modified Vulnerability Status updated
2022-12-18 09:23:44 References updated
2022-12-19 04:27:53 Modified Undergoing Analysis Vulnerability Status updated
2023-02-28 16:12:57 2023-02-28T15:32:28 CVE Modified Date updated
2023-02-28 16:12:57 Undergoing Analysis Analyzed Vulnerability Status updated
2023-02-28 16:12:57 Weakness Enumeration update
2023-04-18 10:02:04 2023-04-18T09:15:08 CVE Modified Date updated
2023-04-18 10:02:04 Analyzed Modified Vulnerability Status updated
2023-04-18 10:02:04 References updated
2023-04-27 04:07:08 2023-04-27T03:15:08 CVE Modified Date updated
2023-04-27 04:07:09 References updated