Important: Red Hat Security Advisory: Service Registry (container images) release and security update [2.3.0.GA]

An update to the images for Red Hat Integration Service Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact o...

SUSE-SU-2022:1040-3 Security update for protobuf

This update for protobuf fixes the following issues: - CVE-2021-22570: Fix incorrect parsing of nullchar in the proto symbol bsc1195258...

GHSA-H4H5-3HR4-J3G2 protobuf-java has a potential Denial of Service issue

Summary A potential Denial of Service issue in protobuf-java core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted...

com.google.ambient.crossdevice:crossdevice (0.1.0-preview01), dev.franckyi.kbuttplug:kbuttplug (0.2.2) potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-kotlin-lite (>=3.21.2, <=3.21.3)

com.google.protobuf:protobuf-kotlin-lite MAVEN version =3.21.2, =3.21.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-kotlin-lite and may be impacted: - com.google.ambient.crossdevice:crossdevice 0.1.0-preview01 -...

ai.tock:tock-nlp-dialogflow (22.3.1), ai.tock:tock-nlp-model-stanford (22.3.1) +1300 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (>=3.20.0-rc-1, <=3.20.2)

com.google.protobuf:protobuf-java MAVEN version =3.20.0-rc-1, =0.10.0, =3.0.0, =0.0.6, =0.0.6, =0.9.5, =2.0.0-alpha.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2025.1.0.0 and more Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...

io.github.dimensiondev:maskwalletcore (>=0.1.0, <=0.4.1) potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-kotlin-lite (>=3.17.1, <=3.17.3)

com.google.protobuf:protobuf-kotlin-lite MAVEN version =3.17.1, =0.1.0, =0.4.1 Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...

co.cask.hbase:hbase (0.94.6.1.cask), com.alibaba:druid (>=0.2.3, <=0.2.4) +108 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (2.4.0a)

com.google.protobuf:protobuf-java MAVEN version 2.4.0a is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - co.cask.hbase:hbase 0.94.6.1.cask - com.alibaba:druid =0.2.3, =1.6, =0.5, =0.5, =1.10, =1.0,...

protobuf-java has a potential Denial of Service issue

Summary A potential Denial of Service issue in protobuf-java core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted...

ai.djl.spring:djl-spring-boot-starter-tensorflow-auto (>=0.15, <=0.18), ai.djl.tensorflow:tensorflow-api (>=0.15.0, <=0.18.0) +7176 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (>=3.17.0-rc-1, <=3.19.5)

com.google.protobuf:protobuf-java MAVEN version =3.17.0-rc-1, =0.15, =0.15.0, =0.15.0, =0.15.0, =3.32.1.6, =3.32.1.6-1-2.1, =3.32.1.6-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.0.1-alpha, =2.8.4-alpha1, =3.0.1-alpha1 and more Source cves:...

be.zvz:kotlininside (>=1.14.0, <=1.14.6), io.github.dimensiondev:maskwalletcore (0.5.0) potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-kotlin-lite (>=3.20.0, <=3.20.1)

com.google.protobuf:protobuf-kotlin-lite MAVEN version =3.20.0, =1.14.0, =1.14.6 - io.github.dimensiondev:maskwalletcore 0.5.0 Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=1.2.2), com.factual:factual-java-driver (>=1.1.0, <=1.7.8) +49 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (2.2.0)

com.google.protobuf:protobuf-java MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin =1.0, =1.1.0, =1.5.0-beta, =1.7.0-beta,...

ai.djl.serving:serving (0.19.0), ai.djl.spring:djl-spring-boot-starter-tensorflow-auto (0.19) +2105 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (>=3.21.0-rc-1, <=3.21.6)

com.google.protobuf:protobuf-java MAVEN version =3.21.0-rc-1, =0.0.1, =22.3.2, =22.3.2, =22.3.2, =22.3.2, =1.0.0-beta01, =1.0.0-beta01, =4.4.0-beta.4, =4.4.0-beta.4, =4.4.0-beta.4, =4.5.0-beta.0 and more Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...

au.com.clearboxsystems.maven.plugins.nodejs:nodejs-maven-plugin (>=1.1, <=1.2.2), br.com.jslsolucoes:tagria-lib (>=2.0.0, <=2.0.5) +1131 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (2.4.1)

com.google.protobuf:protobuf-java MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - au.com.clearboxsystems.maven.plugins.nodejs:nodejs-maven-plugin =1.1, =2.0.0, =1.0.0, =1.3.1,...

com.jamshedalamqaderi.ktransport:generate-proto (>=0.0.1-dev-17, <=1.0.6), com.wavesenterprise:we-contract-sdk-grpc (>=1.0.0, <=1.2.0) +7 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-kotlin (3.20.1)

com.google.protobuf:protobuf-kotlin MAVEN version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-kotlin and may be impacted: - com.jamshedalamqaderi.ktransport:generate-proto =0.0.1-dev-17, =1.0.0, =0.2.0, =0.2.0,...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.bareun.tagger:bareun (1.4.2) +17885 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (>=3.0.0-alpha-2, <=3.16.1)

com.google.protobuf:protobuf-java MAVEN version =3.0.0-alpha-2, =1.4.6, =0.6, =0.6.0, =0.6.0, =0.6.0, =0.11.0, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =1.4.1 and mo...

ai.tock:tock-nlp-dialogflow (22.3.1), ai.tock:tock-nlp-model-stanford (22.3.1) +1300 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (>=3.20.0-rc-1, <=3.20.2)

com.google.protobuf:protobuf-java MAVEN version =3.20.0-rc-1, =0.10.0, =3.0.0, =0.0.6, =0.0.6, =0.9.5, =2.0.0-alpha.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2025.1.0.0 and more Source cves: CVE-2022-3171 Source advisory: GHSA-H4H5-3HR4-J3G2...

com.figure.classification.asset:ac-util (>=2.0.0, <=2.0.0-figuretest10), com.google.privacy.differentialprivacy.pipelinedp4j:pipelinedp4j (>=0.0.1, <=0.0.3) +65 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-kotlin (>=3.17.3, <=3.19.4)

com.google.protobuf:protobuf-kotlin MAVEN version =3.17.3, =2.0.0, =0.0.1, =57.0.0-v202207070922-beta, =57.0.0-v202207070922-beta, =0.8.0, =1.0.0, =1.0.0, =0.1.0, =0.0.1-rc33, =0.2.0, =0.0.1-release, =1.0.0, =1.0.1, =1.0.4 and more Source cves: CVE-2022-3171 Source advisory: GHSA-H4H5-3HR4-J3G2...

be.zvz:kotlininside (>=1.14.0, <=1.14.6), com.google.protobuf:protobuf-kotlin-lite (>=3.20.0-rc-1, <=3.20.2) +8 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-javalite (>=3.20.0-rc-1, <=3.20.2)

com.google.protobuf:protobuf-javalite MAVEN version =3.20.0-rc-1, =1.14.0, =3.20.0-rc-1, =2.12.0, =2.12.0, =2.3.0, =0.2.4, =0.2.6 - io.github.dimensiondev:maskwalletcore 0.5.0 Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...

com.basho.riak.hadoop:riak-hadoop (0.2), com.basho.riak:riak-client (>=0.14.0, <=1.0.5) +114 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (2.3.0)

com.google.protobuf:protobuf-java MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - com.basho.riak.hadoop:riak-hadoop 0.2 - com.basho.riak:riak-client =0.14.0, =0.40, =0.40,...

de.huxhorn.lilith:de.huxhorn.lilith (0.9.35), de.huxhorn.lilith:de.huxhorn.lilith.data.access.protobuf (0.9.35) +16 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (2.0.3)

com.google.protobuf:protobuf-java MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - de.huxhorn.lilith:de.huxhorn.lilith 0.9.35 -...