Critical Vulnerability in Protobuf Package: Potential Denial of Service Attack
Summary
DEBIAN-CVE-2021-22569: An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. Affects protobuf versions < 3.12.4-1+deb11u1. Fixed in 3.12.4-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Protobuf, short for Protocol Buffers, is a language-neutral, platform-neutral extensible mechanism for serializing structured data, developed by Google. It is widely used for data interchange in various applications due to its efficiency and ease of use. However, a vulnerability has been identified in the protobuf-java library that can lead to severe performance issues when processing malicious payloads.
Vulnerability Detail
An issue in protobuf-java allows the interleaving of com.google.protobuf.UnknownFieldSet fields in a manner that can be processed out of order. This vulnerability can be exploited by sending a small malicious payload that occupies the parser for several minutes, creating large numbers of short-lived objects that lead to frequent and repeated pauses. This can result in a Denial of Service (DoS) condition, severely impacting application performance and availability.
How To Fix
Minimum fixed version
3.12.4-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade protobufTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched versions as soon as possible.
Conclusion
The vulnerability in the protobuf package poses a significant risk of Denial of Service attacks due to its ability to process fields out of order. It is crucial for users to upgrade to the patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for protobuf →
FAQ
The vulnerability allows for the processing of fields in an out-of-order manner, which can lead to performance degradation and potential Denial of Service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Failure to address this vulnerability may result in application downtime due to Denial of Service attacks, impacting user experience and operational efficiency.
Yes, for Debian 11, upgrade to version 3.12.4-1+deb11u1 or later. For Debian 12, 13, and 14, upgrade to version 3.21.9-3 or later.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for protobuf.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.