CVE-2022-3509 Security Details

CVE ID

CVE-2022-3509

CWE

CWE-400

NVD-CWE-noinfo

CVE Description

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

Published

Nov 11, 2022

CVSS Score & Severity

7.5High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.139%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/google/protobuf/AbstractMessage$Builder.addRepeatedField(Lcom/google/protobuf/Message$Builder;Lcom/google/protobuf/FieldSet;Lcom/google/protobuf/Descriptors$FieldDescriptor;Ljava/lang/Object;)V

JVMVulnerable params: 2

com/google/protobuf/AbstractMessage$Builder.setField(Lcom/google/protobuf/Message$Builder;Lcom/google/protobuf/FieldSet;Lcom/google/protobuf/Descriptors$FieldDescriptor;Ljava/lang/Object;)V

JVMVulnerable params: 0

com/google/protobuf/MessageReflection$BuilderAdapter.addRepeatedField(Lcom/google/protobuf/Descriptors$FieldDescriptor;Ljava/lang/Object;)Lcom/google/protobuf/MessageReflection$MergeTarget;

JVMVulnerable params: 1

com/google/protobuf/MessageReflection$BuilderAdapter.newMergeTargetForField(Lcom/google/protobuf/Descriptors$FieldDescriptor;Lcom/google/protobuf/Message;)Lcom/google/protobuf/MessageReflection$MergeTarget;

JVMVulnerable params: 0

com/google/protobuf/MessageReflection$BuilderAdapter.setField(Lcom/google/protobuf/Descriptors$FieldDescriptor;Ljava/lang/Object;)Lcom/google/protobuf/MessageReflection$MergeTarget;

JVMVulnerable params: 0

com/google/protobuf/MessageReflection$BuilderAdapter.setRepeatedField(Lcom/google/protobuf/Descriptors$FieldDescriptor;ILjava/lang/Object;)Lcom/google/protobuf/MessageReflection$MergeTarget;

JVMVulnerable params: 2

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · PR #10673PROJECT

debian.orgTHIRD_PARTY