build.buf:protobuf-javalite (>=4.28.0 <=4.28.1), com.auroraoss:gplayapi (=3.4.2) +1 more potentially affected by CVE-2024-7254 via com.google.protobuf:protobuf-javalite (>=4.28.0-RC1 <=4.28.1)

com.google.protobuf:protobuf-javalite MAVEN version =4.28.0-RC1, =4.28.0, =4.28.0, =4.28.1 Source cves: CVE-2024-7254 Source advisory: OSV:GHSA-735F-PC8J-V9W8...

ai.cheq.sst.android:cheq-sst-kotlin-protobuf (>=0.1.0 <=0.1.3), at.asitplus:warden (>=2.1.0 <=2.3.1) +46 more potentially affected by CVE-2024-7254 via com.google.protobuf:protobuf-javalite (>=4.0.0-rc-2 <=4.27.4)

com.google.protobuf:protobuf-javalite MAVEN version =4.0.0-rc-2, =0.1.0, =2.1.0, =1.6.0, =4.26.0, =0.29.1, =0.6.0, =0.1.0, =0.10.13, =0.10.13, =0.10.13, =0.10.13, =0.10.13, =0.10.13, =0.10.13, =0.10.35 and more Source cves: CVE-2024-7254 Source advisory: OSV:GHSA-735F-PC8J-V9W8...

ai.edgestore:engine (=1.0.1-alpha03), androidx.health:health-connect-client (>=1.0.0-alpha01 <=1.0.0-alpha02) +317 more potentially affected by CVE-2024-7254 via com.google.protobuf:protobuf-javalite (>=3.10.0-rc-1 <=3.25.4)

com.google.protobuf:protobuf-javalite MAVEN version =3.10.0-rc-1, =1.0.0-alpha01, =1.0.0, =1.0.0-alpha01, =1.0.0-alpha01, =1.0.0-alpha01, =1.0.0-alpha01, =1.5.0, =2.0.1, =1.14.0, =0.0.0-230221, =0.1.10 and more Source cves: CVE-2024-7254 Source advisory: OSV:GHSA-735F-PC8J-V9W8...

protobuf-java has potential Denial of Service issue

Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team Affected versions: This issue affects all versions of both t...

ai.edgestore:engine (=1.0.1-alpha03), androidx.health:health-connect-client (>=1.0.0-alpha01 <=1.0.0-alpha02) +317 more potentially affected by CVE-2024-7254 via com.google.protobuf:protobuf-javalite (>=3.10.0-rc-1 <=3.25.4)

com.google.protobuf:protobuf-javalite MAVEN version =3.10.0-rc-1, =1.0.0-alpha01, =1.0.0, =1.0.0-alpha01, =1.0.0-alpha01, =1.0.0-alpha01, =1.0.0-alpha01, =1.5.0, =2.0.1, =1.14.0, =0.0.0-230221, =0.1.10 and more Source cves: CVE-2024-7254 Source advisory: SNYK:JAVA-COMGOOGLEPROTOBUF-9398723...

ai.cheq.sst.android:cheq-sst-kotlin-protobuf (>=0.1.0 <=0.1.3), at.asitplus:warden (>=2.1.0 <=2.3.1) +46 more potentially affected by CVE-2024-7254 via com.google.protobuf:protobuf-javalite (>=4.0.0-rc-2 <=4.27.4)

com.google.protobuf:protobuf-javalite MAVEN version =4.0.0-rc-2, =0.1.0, =2.1.0, =1.6.0, =4.26.0, =0.29.1, =0.6.0, =0.1.0, =0.10.13, =0.10.13, =0.10.13, =0.10.13, =0.10.13, =0.10.13, =0.10.13, =0.10.35 and more Source cves: CVE-2024-7254 Source advisory: SNYK:JAVA-COMGOOGLEPROTOBUF-9398723...

build.buf:protobuf-javalite (>=4.28.0 <=4.28.1), com.auroraoss:gplayapi (=3.4.2) +1 more potentially affected by CVE-2024-7254 via com.google.protobuf:protobuf-javalite (>=4.28.0-RC1 <=4.28.1)

com.google.protobuf:protobuf-javalite MAVEN version =4.28.0-RC1, =4.28.0, =4.28.0, =4.28.1 Source cves: CVE-2024-7254 Source advisory: SNYK:JAVA-COMGOOGLEPROTOBUF-9398723...

androidx.health:health-services-client (>=1.0.0-alpha02 <=1.0.0-alpha03), androidx.security:security-crypto (=1.0.0-rc01) +70 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-javalite (>=3.10.0-rc-1 <=3.15.5)

com.google.protobuf:protobuf-javalite MAVEN version =3.10.0-rc-1, =1.0.0-alpha02, =1.2.2, =1.1, =2.15.3unofficial1, =2.15.3unofficial1, =0.2.35-snapshot, =1.3.0, =21.5.0, =25.1.2 and more Source cves: CVE-2022-3510 Source advisory: OSV:GHSA-4GG5-VX3J-XWC7...

build.buf.prototype:connect-kotlin-protoc-gen-javalite-ext (=v0.0.0-test0120), build.buf:connect-kotlin-google-javalite-ext (>=0.0.0-230221 <=0.1.9) +43 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-javalite (>=3.21.0 <=3.21.6)

com.google.protobuf:protobuf-javalite MAVEN version =3.21.0, =0.0.0-230221, =2.15.3unofficial65, =2.15.3unofficial65, =7.0.0.0, =20.3.2, =20.3.2, =3.21.0, =2.15.0, =2.15.0, =2.19.0 - com.ingonoka:grpc-endpoint-authentication-android =v0.2 and more Source cves: CVE-2022-3510 Source advisory:...

be.zvz:KotlinInside (>=1.14.0 <=1.14.6), com.google.protobuf:protobuf-kotlin-lite (>=3.20.0 <=3.20.2) +8 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-javalite (>=3.20.0 <=3.20.2)

com.google.protobuf:protobuf-javalite MAVEN version =3.20.0, =1.14.0, =3.20.0, =2.12.0, =2.12.0, =2.3.0, =0.2.4, =0.2.6 - io.github.dimensiondev:maskwalletcore =0.5.0 Source cves: CVE-2022-3510 Source advisory: OSV:GHSA-4GG5-VX3J-XWC7...

be.zvz:KotlinInside (>=1.14.0 <=1.14.6), com.google.protobuf:protobuf-kotlin-lite (>=3.20.0 <=3.20.2) +8 more potentially affected by CVE-2022-3509 via com.google.protobuf:protobuf-javalite (>=3.20.0 <=3.20.2)

com.google.protobuf:protobuf-javalite MAVEN version =3.20.0, =1.14.0, =3.20.0, =2.12.0, =2.12.0, =2.3.0, =0.2.4, =0.2.6 - io.github.dimensiondev:maskwalletcore =0.5.0 Source cves: CVE-2022-3509 Source advisory: OSV:GHSA-G5WW-5JH7-63CX...

androidx.health:health-services-client (>=1.0.0-alpha02 <=1.0.0-alpha03), androidx.security:security-crypto (=1.0.0-rc01) +70 more potentially affected by CVE-2022-3509 via com.google.protobuf:protobuf-javalite (>=3.10.0-rc-1 <=3.15.5)

com.google.protobuf:protobuf-javalite MAVEN version =3.10.0-rc-1, =1.0.0-alpha02, =1.2.2, =1.1, =2.15.3unofficial1, =2.15.3unofficial1, =0.2.35-snapshot, =1.3.0, =21.5.0, =25.1.2 and more Source cves: CVE-2022-3509 Source advisory: OSV:GHSA-G5WW-5JH7-63CX...

ai.edgestore:engine (=1.0.1-alpha03), androidx.health:health-connect-client (>=1.0.0-alpha01 <=1.0.0-alpha02) +132 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-javalite (>=3.17.0 <=3.19.5)

com.google.protobuf:protobuf-javalite MAVEN version =3.17.0, =1.0.0-alpha01, =2022.12, =2022.12, =7.0.2110, =1.0.0, =0.16.1, =0.16.3.1 and more Source cves: CVE-2022-3510 Source advisory: OSV:GHSA-4GG5-VX3J-XWC7...

build.buf.prototype:connect-kotlin-protoc-gen-javalite-ext (=v0.0.0-test0120), build.buf:connect-kotlin-google-javalite-ext (>=0.0.0-230221 <=0.1.9) +43 more potentially affected by CVE-2022-3509 via com.google.protobuf:protobuf-javalite (>=3.21.0 <=3.21.6)

com.google.protobuf:protobuf-javalite MAVEN version =3.21.0, =0.0.0-230221, =2.15.3unofficial65, =2.15.3unofficial65, =7.0.0.0, =20.3.2, =20.3.2, =3.21.0, =2.15.0, =2.15.0, =2.19.0 - com.ingonoka:grpc-endpoint-authentication-android =v0.2 and more Source cves: CVE-2022-3509 Source advisory:...

build.buf.prototype:connect-kotlin-protoc-gen-javalite-ext (=v0.0.0-test0120), build.buf:connect-kotlin-google-javalite-ext (>=0.0.0-230221 <=0.1.9) +43 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-javalite (>=3.21.0-rc-1 <=3.21.6)

com.google.protobuf:protobuf-javalite MAVEN version =3.21.0-rc-1, =0.0.0-230221, =2.15.3unofficial65, =2.15.3unofficial65, =7.0.0.0, =20.3.2, =20.3.2, =3.21.0, =2.15.0, =2.15.0, =2.19.0 - com.ingonoka:grpc-endpoint-authentication-android =v0.2 and more Source cves: CVE-2022-3171 Source advisory:...

be.zvz:KotlinInside (>=1.14.0 <=1.14.6), com.google.protobuf:protobuf-kotlin-lite (>=3.20.0 <=3.20.2) +8 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-javalite (>=3.20.0-rc-1 <=3.20.2)

com.google.protobuf:protobuf-javalite MAVEN version =3.20.0-rc-1, =1.14.0, =3.20.0, =2.12.0, =2.12.0, =2.3.0, =0.2.4, =0.2.6 - io.github.dimensiondev:maskwalletcore =0.5.0 Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...

ai.edgestore:engine (=1.0.1-alpha03), androidx.health:health-connect-client (>=1.0.0-alpha01 <=1.0.0-alpha02) +132 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-javalite (>=3.17.0-rc-2 <=3.19.5)

com.google.protobuf:protobuf-javalite MAVEN version =3.17.0-rc-2, =1.0.0-alpha01, =2022.12, =2022.12, =7.0.2110, =1.0.0, =0.16.1, =0.16.3.1 and more Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...

androidx.health:health-services-client (>=1.0.0-alpha02 <=1.0.0-alpha03), androidx.security:security-crypto (=1.0.0-rc01) +70 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-javalite (>=3.10.0-rc-1 <=3.15.5)

com.google.protobuf:protobuf-javalite MAVEN version =3.10.0-rc-1, =1.0.0-alpha02, =1.2.2, =1.1, =2.15.3unofficial1, =2.15.3unofficial1, =0.2.35-snapshot, =1.3.0, =21.5.0, =25.1.2 and more Source cves: CVE-2022-3171 Source advisory: OSV:GHSA-H4H5-3HR4-J3G2...