CVE-2021-3121: Open Source Vulnerability in Bitnami Protobuf
Summary
CVE-2021-3121: An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue. Affects protobuf versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- consul · Bitnami
- github.com/gogo/protobuf · Go
- github.com/gogo/protobuf · Go
- github.com/gogo/protobuf · Go
- protobuf-c · Alpine:v3.14
The same CVE-2021-3121 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Bitnami Protobuf is an open-source package that provides support for Protocol Buffers in the Go programming language. Protocol Buffers are a language-agnostic data serialization format developed by Google. They are commonly used for efficient and extensible communication between different systems. Bitnami Protobuf is vulnerable to an issue in the plugin/unmarshal/unmarshal.go file, which lacks certain index validation. This vulnerability is also known as the 'skippy peanut butter' issue.
Vulnerability Detail
The vulnerability in Bitnami Protobuf allows an attacker to exploit the lack of index validation in the unmarshal.go file. By crafting a malicious input, an attacker can trigger an out-of-bounds read or write, leading to potential information disclosure or remote code execution. This vulnerability has a high severity rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) and should be addressed immediately.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of Bitnami Protobuf to ensure the security of your application.
Conclusion
The vulnerability in Bitnami Protobuf (CVE-2021-3121) exposes applications to potential information disclosure or remote code execution. It is crucial to update to version 1.3.2 or later to mitigate this risk. There is no known workaround for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for protobuf →
FAQ
Bitnami Protobuf is an open-source package that provides support for Protocol Buffers in the Go programming language. It allows developers to efficiently serialize and deserialize structured data for communication between different systems.
This vulnerability allows an attacker to exploit the lack of index validation in Bitnami Protobuf, potentially leading to information disclosure or remote code execution. It is crucial to update to the latest version to mitigate this risk.
You can update Bitnami Protobuf by following the instructions provided by the Bitnami Protobuf documentation or using your package manager. It is recommended to update to version 1.3.2 or later.
There is no known workaround for this vulnerability. It is essential to update to the latest version of Bitnami Protobuf to ensure the security of your application.
For more information about this vulnerability, you can refer to the official CVE entry (CVE-2021-3121) or the Bitnami Protobuf documentation. Additionally, you can reach out to info@devnack.com for further support on vulnerability remediation.
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
