Interleaving Vulnerability in Protobuf Package Leading to Denial of Service
Summary
CVE-2021-22569: An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. Affects protobuf across 2 version ranges.
< 3.12.4-1+deb11u1
< cb46755e6405e083b45481f5ea4754b180705529
Fixed in 3.12.4-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Protobuf, short for Protocol Buffers, is a language-agnostic binary serialization format developed by Google. It is widely used for data interchange between services due to its efficiency and compactness. The package is integral in various applications, enabling structured data communication. However, a vulnerability has been identified that allows for the interleaving of UnknownFieldSet fields, potentially leading to performance degradation and denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2021-22569, arises from a flaw in the protobuf-java implementation that permits the interleaving of UnknownFieldSet fields. This can result in the parser being occupied by a malicious payload for extended periods, creating numerous short-lived objects that lead to frequent pauses in processing. The ramifications include a significant slowdown of the application, which could be exploited to cause a denial of service. The vulnerability affects multiple versions of the protobuf package across different Debian ecosystems.
How To Fix
Minimum fixed version
3.12.4-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade protobufTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the recommended upgrades to mitigate the risk.
Conclusion
CVE-2021-22569 is a significant vulnerability in the protobuf package that can lead to denial of service through the interleaving of UnknownFieldSet fields. It is crucial to upgrade to the recommended versions to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for protobuf →
FAQ
CVE-2021-22569 is a vulnerability in the protobuf-java library that allows for the interleaving of UnknownFieldSet fields, potentially leading to denial of service.
Exploitation of this vulnerability can cause your application to experience significant slowdowns, leading to potential denial of service.
The vulnerability affects multiple versions of the protobuf package across Debian 11, 12, and 13 ecosystems.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The CVSS score for CVE-2021-22569 is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.