| Package | Affected versions | Patched versions |
|---|---|---|
| com.google.protobuf:protobuf-java | ≥ 3.18.0, < 3.18.2≥ 3.19.0, < 3.19.2< 3.16.1 | 3.18.23.19.23.16.1 |
| com.google.protobuf:protobuf-kotlin | ≥ 3.18.0, < 3.18.2≥ 3.19.0, < 3.19.2 | 3.18.23.19.2 |
| google-protobuf | < 3.19.2 | 3.19.2 |
| google-protobuf | < 3.19.2 | 3.19.2 |
| protobuf-java | ≥ 3.18.0, < 3.18.2≥ 3.19.0, < 3.19.2< 3.16.1 | 3.18.23.19.23.16.1 |
| protobuf-kotlin | ≥ 3.19.0, < 3.19.2< 3.18.2 | 3.19.23.18.2 |
| communications cloud native core console | = 1.9.0 | |
| communications cloud native core network repository function | = 1.15.0= 1.15.1 | |
| communications cloud native core policy | = 1.15.0 | |
| spatial and graph mapviewer | = 19c= 21c |
A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data.
Reporter: OSS-Fuzz
Affected versions: All versions of Java Protobufs (including Kotlin and JRuby) prior to the versions listed below. Protobuf "javalite" users (typically Android) are not affected.
CVE-2021-22569 High - CVSS Score: 7.5, An implementation weakness in how unknown fields are parsed in Java. A small (~800 KB) malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated GC pauses.
For reproduction details, please refer to the oss-fuzz issue that identifies the specific inputs that exercise this parsing weakness.
Please update to the latest available versions of the following packages:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free