CVE-2022-1941 Out of Memory issue in ProtocolBuffers for cpp and python
Attackers can cause denial of service in applications using Protocol Buffers by sending specially crafted messages that trigger out-of-memory failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1941?
CVE-2022-1941 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 22 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
Weakness: CWE-1286
Which versions are affected by CVE-2022-1941?
9 open source packages ship an affected version, including protobuf. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
protobuf PyPI | All versions | 3.18.3, 3.19.5, 3.20.2, 4.21.6 |
protobuf PyPI | All versions | 3.18.3 |
protobuf PyPI | All versions | 3.18.3 |
protobuf PyPI | From 3.19.0 | 3.19.5 |
protobuf PyPI | From 3.19.0 | 3.19.5 |
protobuf PyPI | From 3.20.0 | 3.20.2 |
3 more packages
protobuf PyPI | From 3.20.0 | 3.20.2 |
protobuf PyPI | From 4.0.0 | 4.21.6 |
protobuf PyPI | From 4.0.0 | 4.21.6 |
Linux distribution packages (21)
protobuf AlmaLinux:9 | All versions | 3.14.0-16.el9 |
protobuf-compiler AlmaLinux:9 | All versions | 3.14.0-16.el9 |
protobuf-devel AlmaLinux:9 | All versions | 3.14.0-16.el9 |
protobuf-lite AlmaLinux:9 | All versions | 3.14.0-16.el9 |
protobuf-lite-devel AlmaLinux:9 | All versions | 3.14.0-16.el9 |
python3-protobuf AlmaLinux:9 | All versions | 3.14.0-16.el9 |
protobuf Red Hat:enterprise_linux:9::appstream | All versions | 0:3.14.0-16.el9 |
protobuf-compiler-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.14.0-16.el9 |
protobuf-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.14.0-16.el9 |
protobuf-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:3.14.0-16.el9 |
protobuf-lite Red Hat:enterprise_linux:9::appstream | All versions | 0:3.14.0-16.el9 |
protobuf-lite-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.14.0-16.el9 |
python3-protobuf Red Hat:enterprise_linux:9::appstream | All versions | 0:3.14.0-16.el9 |
protobuf-compiler Red Hat:enterprise_linux:9::crb | All versions | 0:3.14.0-16.el9 |
protobuf-compiler-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:3.14.0-16.el9 |
protobuf-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:3.14.0-16.el9 |
protobuf-debugsource Red Hat:enterprise_linux:9::crb | All versions | 0:3.14.0-16.el9 |
protobuf-devel Red Hat:enterprise_linux:9::crb | All versions | 0:3.14.0-16.el9 |
protobuf-lite-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:3.14.0-16.el9 |
protobuf-lite-devel Red Hat:enterprise_linux:9::crb | All versions | 0:3.14.0-16.el9 |
protobuf Rocky Linux:9 | All versions | 0:3.14.0-16.el9 |
Products include Debian Debian Linux, Fedoraproject Fedora, Google Protobuf-Cpp, Google Protobuf-Python.
How do I fix CVE-2022-1941?
Upgrade protobuf to a fixed version for your release line: 3.18.3, 3.19.5, 3.20.2 or 4.21.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-1941 being exploited?
There is no known exploitation of CVE-2022-1941 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2025:7138, AZL-13172, AZL-13174, AZL-25856, AZL-35018, AZL-35125 and 14 more.