CVE-2022-23571: Reachable Assertion

Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHECK assertion is invalidated based on user controlled arguments, if the tensors have an invalid dtype and 0 elements or an invalid shape. This allows...

PT-2022-16087

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.0 through 2.7.1 TensorFlow versions 2.6.0 through 2.6.3 Description When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments...

PT-2022-16088

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.3 TensorFlow versions prior to 2.6.3 TensorFlow versions prior to 2.7.1 TensorFlow versions prior to 2.8.0 Description When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a CHEC...

CVE-2022-23570: NULL Pointer Dereference

Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK. However, DCHECK is a no-op in production builds...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.7.42 security update

Red Hat OpenShift Container Platform release 4.7.42 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.7. Red Hat Product Security has rated this update as having a...

CVE-2021-22570

A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute unauthorized code or commands, read memory, modify memory...

Mageia: Security Advisory (MGASA-2020-0345)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

abeja-sdk (>=1.0.2rc1, <=1.0.2), acg-feature-extractor (0.0.2) +412 more potentially affected by CVE-2021-22570 via protobuf (>=3.0.0a3, <=3.14.0)

protobuf PYPI version =3.0.0a3, =1.0.2rc1, =0.1.2, =0.0.5, =1.1.2, =0.7.1, =0.1.0, =0.1.0, =0.1.0, =1.7.0, =0.1.1, =2.0.0, =2.0.1, =2.0.2 and more Source cves: CVE-2021-22570 Source advisory: OSV:PYSEC-2022-48...

baosnetlib-python (0.1.0), etcd-apiv3 (2.3.0.1) +2 more potentially affected by CVE-2021-22570 via protobuf (2.6.1)

protobuf PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - baosnetlib-python 0.1.0 - etcd-apiv3 2.3.0.1 - kaircs 0.4.0 - labeless =1.1.2.48, =1.1.6.0 Source cves: CVE-2021-22570 Source advisory:...

Google protobuf 代码问题漏洞

Google protobuf is a data interchange format from Google, Inc. A code issue vulnerability exists in Google protobuf that stems from Nullptr dereferencing when null characters are present in the original symbol. The symbols are parsed incorrectly, resulting in an unchecked call to the name of the...

CVE-2021-22570 Nullptr Dereference in Protobuf

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to...

CVE-2021-22570 Nullptr Dereference in Protobuf

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to...

CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

DEBIAN-CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

AZL-41431 CVE-2021-22569 affecting package pytorch for versions less than 2.2.2-5

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

Code injection

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

UBUNTU-CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

Denial Of Service (DoS)

protobuf is vulnerable to Denial of Service DoS. The library does not properly handle unknown fields in the UnknownFieldSet function in UnknownFieldSet.java, allowing an attacker to crash the application through many short-lived objects by providing malicious payload...