CVE-2022-3510: Protobuf Java Uncontrolled Resource Consumption
Summary
CVE-2022-3510: Protobuf Java vulnerable to Uncontrolled Resource Consumption. Affects com.google.protobuf:protobuf-java across 4 version ranges.
< 3.16.3
>= 3.17.0, < 3.19.6
>= 3.20.0, < 3.20.3
>= 3.21.0, < 3.21.7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- protobuf · Debian:11
The same CVE-2022-3510 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Protobuf Java is a library that provides support for Protocol Buffers, a language-agnostic binary serialization format. It is widely used for efficient data exchange and storage. However, versions prior to 3.16.3 are vulnerable to uncontrolled resource consumption due to a parsing issue. This vulnerability can be exploited through inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields. As a result, objects are converted back and forth between mutable and immutable forms, leading to potentially long garbage collection pauses.
Vulnerability Detail
The vulnerability in Protobuf Java can result in a denial of service (DoS) attack. By sending specially crafted inputs, an attacker can trigger the resource consumption issue, causing excessive garbage collection pauses and potentially impacting the availability and performance of the affected system. This vulnerability is similar to CVE-2022-3171 but specifically affects Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.16.33.16.3 -
>= 3.17.0, < 3.19.63.19.6 -
>= 3.20.0, < 3.20.33.20.3 -
>= 3.21.0, < 3.21.73.21.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to update to the fixed versions mentioned above.
Conclusion
The vulnerability in Protobuf Java versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3 can lead to uncontrolled resource consumption, potentially resulting in a denial of service attack. It is crucial to update the affected packages to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.google.protobuf:protobuf-java →
FAQ
Protobuf Java is a library that provides support for Protocol Buffers, a language-agnostic binary serialization format. It is widely used for efficient data exchange and storage.
The vulnerability can lead to a denial of service (DoS) attack by causing excessive garbage collection pauses. This can impact the availability and performance of the affected system.
No, only versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3 are affected by this vulnerability.
No specific workaround is provided. It is recommended to update to the fixed versions to address the vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.google.protobuf:protobuf-java.
