CVE-2021-22569: Denial of Service Vulnerability in protobuf-java
Summary
CVE-2021-22569: A potential Denial of Service issue in protobuf-java. Affects com.google.protobuf:protobuf-java across 3 version ranges.
< 3.16.1
>= 3.18.0, < 3.18.2
>= 3.19.0, < 3.19.2
Fixed in 3.16.1, 3.18.2 or 3.19.2, depending on the release line you run. How to fix ↓
Also tracked for
- protobuf · Debian:11
The same CVE-2021-22569 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The protobuf-java package is an open-source library that provides support for Protocol Buffers, a language-agnostic binary serialization format developed by Google. It allows developers to define the structure of their data using a simple language and generate code in various programming languages to serialize and deserialize the data. This vulnerability affects all versions of Java Protobufs (including Kotlin and JRuby) prior to the fixed versions. It is important to note that Protobuf "javalite" users, typically Android, are not affected by this vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2021-22569, is a potential Denial of Service (DoS) issue in protobuf-java. It stems from an implementation weakness in how unknown fields are parsed in Java. An attacker can exploit this weakness by sending a small (~800 KB) malicious payload that creates a large number of short-lived objects, causing frequent garbage collection (GC) pauses. This can lead to a DoS condition where the parser is occupied for several minutes, impacting the availability of the system. The vulnerability has a CVSS score of 7.5, indicating its high severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.16.13.16.1 -
>= 3.18.0, < 3.18.23.18.2 -
>= 3.19.0, < 3.19.23.19.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in protobuf-java (CVE-2021-22569) poses a high risk due to its potential for causing a Denial of Service (DoS) condition. It is crucial to update the affected packages to the fixed versions mentioned above to ensure the security and availability of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.google.protobuf:protobuf-java →
FAQ
The vulnerability can be exploited to cause a Denial of Service (DoS) condition, where the parser is occupied for several minutes, impacting the availability of the system.
All versions of Java Protobufs (including Kotlin and JRuby) prior to the fixed versions are affected.
No, Protobuf "javalite" users, typically Android, are not affected by this vulnerability.
The CVSS score of this vulnerability is 7.5, indicating its high severity.
To mitigate the risk, it is recommended to update the affected packages to the latest available versions.
Related vulnerabilities
Recent vulnerabilities recorded for com.google.protobuf:protobuf-java.
