CVE-2021-22569

🗓️ 07 Jan 2022 00:00:00Reported by GoogleType

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses

Reporter	Title	Published	Views	Family All 118
IBM Security Bulletins	Security Bulletin: Vulnerability from Google Protocol Buffer affect IBM Operations Analytics - Log Analysis (CVE-2021-22569)	7 Nov 202211:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities	4 Sep 202311:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities	8 Apr 202220:24	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities found within Apache Storm that is used by IBM Tivoli Network Manager (ITNM) IP Edition	24 Feb 202306:34	–	ibm
IBM Security Bulletins	Security Bulletin: User Entity Behavior Analytics app for IBM QRadar SIEM includes components with known vulnerabilities	17 Oct 202515:07	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities with DataStage on Cloud Pak for Data related to Apache hbase-client 2.4.15	18 Mar 202514:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities	29 Sep 202318:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	8 Nov 202220:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting IBM Knowledge Catalog for IBM Cloud Pak for Data	1 Jul 202522:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	5 May 202316:01	–	ibm

NVD

Vulners

Node

google google-protobufRange<3.19.2ruby

google protobuf-javaRange<3.16.1

google protobuf-javaRange3.18.0–3.18.2

google protobuf-javaRange3.19.0–3.19.2

google protobuf-kotlinRange<3.18.2

google protobuf-kotlinRange3.19.0–3.19.2

Node

oracle communications_cloud_native_core_consoleMatch1.9.0

oracle communications_cloud_native_core_network_repository_functionMatch1.15.0

oracle communications_cloud_native_core_network_repository_functionMatch1.15.1

oracle communications_cloud_native_core_policyMatch1.15.0

oracle spatial_and_graph_mapviewerMatch19c

oracle spatial_and_graph_mapviewerMatch21c

[
  {
    "vendor": "Google LLC",
    "product": "protobuf-java",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "3.16.1",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "3.18.2",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "3.19.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Google LLC",
    "product": "protobuf-kotlin",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "3.18.2",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "3.19.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Google LLC",
    "product": "google-protobuf [JRuby Gem]",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "3.19.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
cloud	www.cloud.google.com/support/bulletins
lists	www.lists.debian.org/debian-lts-announce/2023/04/msg00019.html
openwall	www.openwall.com/lists/oss-security/2022/01/12/7
bugs	www.bugs.chromium.org/p/oss-fuzz/issues/detail
openwall	www.openwall.com/lists/oss-security/2022/01/12/4
oracle	www.oracle.com/security-alerts/cpuapr2022.html

21 Nov 2024 05:50Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.3

CVSS 3.15.5 - 7.5

EPSS0.00471

SSVC

CWE-696