ai.edgestore:engine (1.0.1-alpha03), androidx.health:health-connect-client (>=1.0.0-alpha01, <=1.0.0-alpha02) +132 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-javalite (>=3.17.0-rc-2, <=3.19.5)

com.google.protobuf:protobuf-javalite MAVEN version =3.17.0-rc-2, =1.0.0-alpha01, =2022.12, =2022.12, =7.0.2110, =1.0.0, =0.16.1, =0.16.3.1 and more Source cves: CVE-2022-3171 Source advisory: GHSA-H4H5-3HR4-J3G2...

com.figure.classification.asset:ac-util (>=2.0.0, <=2.0.0-figuretest10), com.google.privacy.differentialprivacy.pipelinedp4j:pipelinedp4j (>=0.0.1, <=0.0.3) +65 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-kotlin (>=3.17.3, <=3.19.4)

com.google.protobuf:protobuf-kotlin MAVEN version =3.17.3, =2.0.0, =0.0.1, =57.0.0-v202207070922-beta, =57.0.0-v202207070922-beta, =0.8.0, =1.0.0, =1.0.0, =0.1.0, =0.0.1-rc33, =0.2.0, =0.0.1-release, =1.0.0, =1.0.1, =1.0.4 and more Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3...

ai.djl.spring:djl-spring-boot-starter-tensorflow-auto (>=0.15, <=0.18), ai.djl.tensorflow:tensorflow-api (>=0.15.0, <=0.18.0) +7176 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-java (>=3.17.0-rc-1, <=3.19.5)

com.google.protobuf:protobuf-java MAVEN version =3.17.0-rc-1, =0.15, =0.15.0, =0.15.0, =0.15.0, =3.32.1.6, =3.32.1.6-1-2.1, =3.32.1.6-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.0.1-alpha, =2.8.4-alpha1, =3.0.1-alpha1 and more Source cves:...

Denial of Service (DoS)

Overview google-protobuf is a Google's data interchange format. Affected versions of this package are vulnerable to Denial of Service DoS via the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unkno...

com.google.ambient.crossdevice:crossdevice (0.1.0-preview01), dev.franckyi.kbuttplug:kbuttplug (0.2.2) potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-kotlin-lite (>=3.21.2, <=3.21.3)

com.google.protobuf:protobuf-kotlin-lite MAVEN version =3.21.2, =3.21.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-kotlin-lite and may be impacted: - com.google.ambient.crossdevice:crossdevice 0.1.0-preview01 -...

PT-2022-5139

Name of the Vulnerable Software and Affected Versions protobuf-java versions prior to 3.21.7 protobuf-java versions prior to 3.20.3 protobuf-java versions prior to 3.19.6 protobuf-java versions prior to 3.16.3 Jira Service Management affected versions not specified Jira Work Management affected...

protobuf-java has a potential Denial of Service issue

Summary A potential Denial of Service issue in protobuf-java core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted...

PT-2022-6746

Name of the Vulnerable Software and Affected Versions protobuf-java core and lite versions prior to 3.21.7 protobuf-java core and lite versions prior to 3.20.3 protobuf-java core and lite versions prior to 3.19.6 protobuf-java core and lite versions prior to 3.16.3 Description A parsing issue in...

GHSA-8GQ9-2X98-W8HF protobuf-cpp and protobuf-python have potential Denial of Service issue

Summary A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory OOM failure when processing a specially crafted message, which could lead to a denial of service DoS on services using the libraries. Reporter: ClusterFuzz...

abeja-sdk (>=1.0.2rc1, <=1.0.2), acg-feature-extractor (0.0.2) +554 more potentially affected by CVE-2022-1941 via protobuf (>=3.0.0a3, <=3.18.1)

protobuf PYPI version =3.0.0a3, =1.0.2rc1, =0.1.2, =0.0.5, =1.1.2, =0.7.1, =0.1.0, =0.1.0, =0.1.0, =2022.9.19, =1.7.0, =0.1.0, =0.3.0 and more Source cves: CVE-2022-1941 Source advisory: OSV:GHSA-8GQ9-2X98-W8HF...

abba-python (>=0.1.6, <=0.3.0), abeja-sdk (>=2.2.0rc1, <=2.3.5rc1) +536 more potentially affected by CVE-2022-1941 via protobuf (>=3.20.0, <=3.20.1)

protobuf PYPI version =3.20.0, =0.1.6, =2.2.0rc1, =0.8.3, =0.1.0, =0.0.0, =1.0.43, =0.1.6, =0.3.1a1, =1.0.0, =0.10.0, =0.20.0 and more Source cves: CVE-2022-1941 Source advisory: OSV:GHSA-8GQ9-2X98-W8HF...

baosnetlib-python (0.1.0), etcd-apiv3 (2.3.0.1) +2 more potentially affected by CVE-2022-1941 via protobuf (2.6.1)

protobuf PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - baosnetlib-python 0.1.0 - etcd-apiv3 2.3.0.1 - kaircs 0.4.0 - labeless =1.1.2.48, =1.1.6.0 Source cves: CVE-2022-1941 Source advisory:...

ad-components (>=0.1.5, <=0.1.6), advance-common (>=1.1.0, <=1.3.1) +198 more potentially affected by CVE-2022-1941 via protobuf (>=3.19.0, <=3.19.4)

protobuf PYPI version =3.19.0, =0.1.5, =1.1.0, =1.2.1, =0.13.0, =1.5.0, =3.0.4, =0.3.0, =0.8.0, =1.1.2, =0.1.0a1, =0.0.1, =0.1.2, =0.2.5 and more Source cves: CVE-2022-1941 Source advisory: OSV:GHSA-8GQ9-2X98-W8HF...

aipose (>=0.4.0, <=3.2.0), alphafed (>=0.1.0, <=0.1.1) +46 more potentially affected by CVE-2022-1941 via protobuf (>=4.21.0rc2, <=4.21.5)

protobuf PYPI version =4.21.0rc2, =0.4.0, =0.1.0, =0.1.2, =0.0.12, =0.2.6, =0.0.20, =1.2.0, =1.1.2, =0.0.1, =0.0.7, =0.1.2, =0.1.4 - librespot 0.0.2 and more Source cves: CVE-2022-1941 Source advisory: OSV:GHSA-8GQ9-2X98-W8HF...

worldengine (0.18.0) potentially affected by CVE-2022-1941 via protobuf (2.6.0)

protobuf PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - worldengine 0.18.0 Source cves: CVE-2022-1941 Source advisory: OSV:GHSA-8GQ9-2X98-W8HF...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the MessageSet type, by allowing an attacker to send specially crafted message with multiple key-value per elements, therefore creating parsing issues against services which receive unsanitized input. Details...

AZL-35018 CVE-2022-1941 affecting package mysql for versions less than 8.0.40-1

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of...

AZL-25856 CVE-2022-1941 affecting package pytorch for versions less than 2.0.0-7

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of...

DEBIAN-CVE-2022-1941

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of...

AZL-39031 CVE-2022-1941 affecting package keras for versions less than 3.1.1-1

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of...