Google protobuf 安全漏洞

Google protobuf is a data exchange format from Google, Inc. A security vulnerability exists in Google protobuf java that allows a small malicious load to occupy the parser for several minutes by creating a large number of short-lived objects that cause frequent, repetitive pauses...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +8589 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (2.5.0)

com.google.protobuf:protobuf-java MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - ae.teletronics.nlp:entityextraction 1.3 - ae.teletronics.nlp:w2vec 1.0 -...

co.cask.hbase:hbase (0.94.6.1.cask), com.alibaba:druid (>=0.2.3, <=0.2.4) +108 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (2.4.0a)

com.google.protobuf:protobuf-java MAVEN version 2.4.0a is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - co.cask.hbase:hbase 0.94.6.1.cask - com.alibaba:druid =0.2.3, =1.6, =0.5, =0.5, =1.10, =1.0,...

au.com.clearboxsystems.maven.plugins.nodejs:nodejs-maven-plugin (>=1.1, <=1.2.2), br.com.jslsolucoes:tagria-lib (>=2.0.0, <=2.0.5) +1131 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (2.4.1)

com.google.protobuf:protobuf-java MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - au.com.clearboxsystems.maven.plugins.nodejs:nodejs-maven-plugin =1.1, =2.0.0, =1.0.0, =1.3.1,...

com.figure.classification.asset:ac-util (>=2.0.0, <=2.0.0-figuretest10), de.fhg.aisec.ids:idscp2-ra-cmc (>=0.8.0, <=0.8.1.1) +50 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-kotlin (>=3.19.0, <=3.19.1)

com.google.protobuf:protobuf-kotlin MAVEN version =3.19.0, =2.0.0, =0.8.0, =0.0.1-rc33, =0.2.0, =0.0.0-test3, =1.0.0-rc6, =1.1.0, =1.0.1, =0.0.3, =1.2.0, =v2.5.2-beta1, =1.2.0, =2.3.2 and more Source cves: CVE-2021-22569 Source advisory: GHSA-WRVW-HG22-4M67...

cn.ac.ios.tis:riscvspeccore_2.12 (>=0.1.0, <=1.0.0), cn.dustlight.flow:flow-zeebe (>=0.1.3-alpha, <=0.1.7-alpha) +1037 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.18.0, <=3.18.1)

com.google.protobuf:protobuf-java MAVEN version =3.18.0, =0.1.0, =0.1.3-alpha, =0.0.1-alpha, =0.0.2-alpha - cn.vertxup:vertx-co 0.7.0 - cn.vertxup:vertx-ifx 0.7.0 - cn.vertxup:vertx-import 0.7.0 - cn.vertxup:vertx-pin 0.7.0 - cn.vertxup:vertx-rx 0.7.0 - cn.vertxup:vertx-tp 0.7.0 -...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.bareun.tagger:bareun (1.4.2) +17669 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.0.0-alpha-2, <=3.16.0)

com.google.protobuf:protobuf-java MAVEN version =3.0.0-alpha-2, =1.4.6, =0.6, =0.6.0, =0.6.0, =0.6.0, =0.11.0, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =1.4.1 and mo...

com.figure.classification.asset:ac-util (>=2.0.0, <=2.0.0-figuretest10), de.fhg.aisec.ids:idscp2-ra-cmc (>=0.8.0, <=0.8.1.1) +50 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-kotlin (>=3.19.0, <=3.19.1)

com.google.protobuf:protobuf-kotlin MAVEN version =3.19.0, =2.0.0, =0.8.0, =0.0.1-rc33, =0.2.0, =0.0.0-test3, =1.0.0-rc6, =1.1.0, =1.0.1, =0.0.3, =1.2.0, =v2.5.2-beta1, =1.2.0, =2.3.2 and more Source cves: CVE-2021-22569 Source advisory: OSV:GHSA-WRVW-HG22-4M67...

ai.superstream:kafka-clients (>=3.0.1-alpha, <=3.6.1-alpha1), ai.superstream:spring-kafka (>=2.8.4-alpha1, <=3.0.1-alpha1) +1387 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.19.0, <=3.19.1)

com.google.protobuf:protobuf-java MAVEN version =3.19.0, =3.0.1-alpha, =2.8.4-alpha1, =0.0.1-alpha1, =21.9.4, =21.9.4, =21.9.4, =21.9.4, =0.6.9-rc.2, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.4 and more Source cves: CVE-2021-22569 Source advisory: GHSA-WRVW-HG22-4M67...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=1.2.2), com.factual:factual-java-driver (>=1.1.0, <=1.7.8) +49 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (2.2.0)

com.google.protobuf:protobuf-java MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin =1.0, =1.1.0, =1.5.0-beta, =1.7.0-beta,...

A potential Denial of Service issue in protobuf-java

Summary A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data. Reporter: OSS-Fuzz Affected versions: All versions of Java Protobufs including Kotlin and JRuby prior to the versions listed below. Protobuf "javalite" users typically Android are...

ai.superstream:kafka-clients (>=3.0.1-alpha, <=3.6.1-alpha1), ai.superstream:spring-kafka (>=2.8.4-alpha1, <=3.0.1-alpha1) +1387 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.19.0, <=3.19.1)

com.google.protobuf:protobuf-java MAVEN version =3.19.0, =3.0.1-alpha, =2.8.4-alpha1, =0.0.1-alpha1, =21.9.4, =21.9.4, =21.9.4, =21.9.4, =0.6.9-rc.2, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.4 and more Source cves: CVE-2021-22569 Source advisory: OSV:GHSA-WRVW-HG22-4M6...

com.google.privacy.differentialprivacy.pipelinedp4j:pipelinedp4j (>=0.0.1, <=0.0.3) potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-kotlin (3.18.0)

com.google.protobuf:protobuf-kotlin MAVEN version 3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-kotlin and may be impacted: - com.google.privacy.differentialprivacy.pipelinedp4j:pipelinedp4j =0.0.1, =0.0.3 Source...

de.huxhorn.lilith:de.huxhorn.lilith (0.9.35), de.huxhorn.lilith:de.huxhorn.lilith.data.access.protobuf (0.9.35) +16 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (2.0.3)

com.google.protobuf:protobuf-java MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-java and may be impacted: - de.huxhorn.lilith:de.huxhorn.lilith 0.9.35 -...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.bareun.tagger:bareun (1.4.2) +17669 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.0.0-alpha-2, <=3.16.0)

com.google.protobuf:protobuf-java MAVEN version =3.0.0-alpha-2, =1.4.6, =0.6, =0.6.0, =0.6.0, =0.6.0, =0.11.0, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =1.4.1 and mo...

GHSA-WRVW-HG22-4M67 A potential Denial of Service issue in protobuf-java

Summary A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data. Reporter: OSS-Fuzz Affected versions: All versions of Java Protobufs including Kotlin and JRuby prior to the versions listed below. Protobuf "javalite" users typically Android are...

Denial of Service (DoS)

Overview google-protobuf is a Google's data interchange format. Affected versions of this package are vulnerable to Denial of Service DoS. An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +27485 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=2.0.3, <=3.16.0)

com.google.protobuf:protobuf-java MAVEN version =2.0.3, =1.4.6, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2.10 and more Source cves: CVE-2021-22569 Source advisory: MEND:CVE-2021-22569...

CVE-2021-22569

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated...

ai.superstream:kafka-clients (>=3.0.1-alpha, <=3.6.1-alpha1), ai.superstream:spring-kafka (>=2.8.4-alpha1, <=3.0.1-alpha1) +1387 more potentially affected by CVE-2021-22569 via com.google.protobuf:protobuf-java (>=3.19.0, <=3.19.1)

com.google.protobuf:protobuf-java MAVEN version =3.19.0, =3.0.1-alpha, =2.8.4-alpha1, =0.0.1-alpha1, =21.9.4, =21.9.4, =21.9.4, =21.9.4, =0.6.9-rc.2, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.3, =0.10.4 and more Source cves: CVE-2021-22569 Source advisory: MEND:CVE-2021-22569...