usn-5945-1
Vulnerability from osv_ubuntu
Published
2023-03-13 06:07
Modified
2026-06-29 10:53
Summary
protobuf vulnerabilities
Details
It was discovered that Protocol Buffers did not properly validate field com.google.protobuf.UnknownFieldSet in protobuf-java. An attacker could possibly use this issue to perform a denial of service attack. This issue only affected protobuf Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2021-22569)
It was discovered that Protocol Buffers did not properly parse certain symbols. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. (CVE-2021-22570)
It was discovered that Protocol Buffers did not properly manage memory when parsing specifically crafted messages. An attacker could possibly use this issue to cause applications using protobuf to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-1941)
References
{
"affected": [
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2021-22569",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2021-22570",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:14.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "libprotobuf-java",
"binary_version": "2.5.0-9ubuntu1+esm1"
},
{
"binary_name": "libprotobuf-lite8",
"binary_version": "2.5.0-9ubuntu1+esm1"
},
{
"binary_name": "libprotobuf8",
"binary_version": "2.5.0-9ubuntu1+esm1"
},
{
"binary_name": "libprotoc8",
"binary_version": "2.5.0-9ubuntu1+esm1"
},
{
"binary_name": "protobuf-compiler",
"binary_version": "2.5.0-9ubuntu1+esm1"
},
{
"binary_name": "python-protobuf",
"binary_version": "2.5.0-9ubuntu1+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "protobuf",
"purl": "pkg:deb/ubuntu/protobuf@2.5.0-9ubuntu1+esm1?arch=source\u0026distro=trusty/esm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.0-9ubuntu1+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.1-3ubuntu2",
"2.4.1-3ubuntu3",
"2.4.1-3ubuntu4",
"2.5.0-5ubuntu2",
"2.5.0-7ubuntu1",
"2.5.0-8ubuntu1",
"2.5.0-9ubuntu1"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2021-22569",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2021-22570",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2022-1941",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:18.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libprotobuf-java",
"binary_version": "3.0.0-9.1ubuntu1.1"
},
{
"binary_name": "libprotobuf-lite10",
"binary_version": "3.0.0-9.1ubuntu1.1"
},
{
"binary_name": "libprotobuf10",
"binary_version": "3.0.0-9.1ubuntu1.1"
},
{
"binary_name": "libprotoc10",
"binary_version": "3.0.0-9.1ubuntu1.1"
},
{
"binary_name": "protobuf-compiler",
"binary_version": "3.0.0-9.1ubuntu1.1"
},
{
"binary_name": "python-protobuf",
"binary_version": "3.0.0-9.1ubuntu1.1"
},
{
"binary_name": "python3-protobuf",
"binary_version": "3.0.0-9.1ubuntu1.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "protobuf",
"purl": "pkg:deb/ubuntu/protobuf@3.0.0-9.1ubuntu1.1?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0-9.1ubuntu1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0-9ubuntu5",
"3.0.0-9ubuntu6",
"3.0.0-9.1ubuntu1"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2021-22569",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2021-22570",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2022-1941",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:20.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libprotobuf-java",
"binary_version": "3.6.1.3-2ubuntu5.2"
},
{
"binary_name": "libprotobuf-lite17",
"binary_version": "3.6.1.3-2ubuntu5.2"
},
{
"binary_name": "libprotobuf17",
"binary_version": "3.6.1.3-2ubuntu5.2"
},
{
"binary_name": "libprotoc17",
"binary_version": "3.6.1.3-2ubuntu5.2"
},
{
"binary_name": "protobuf-compiler",
"binary_version": "3.6.1.3-2ubuntu5.2"
},
{
"binary_name": "python-protobuf",
"binary_version": "3.6.1.3-2ubuntu5.2"
},
{
"binary_name": "python3-protobuf",
"binary_version": "3.6.1.3-2ubuntu5.2"
},
{
"binary_name": "ruby-google-protobuf",
"binary_version": "3.6.1.3-2ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:20.04:LTS",
"name": "protobuf",
"purl": "pkg:deb/ubuntu/protobuf@3.6.1.3-2ubuntu5.2?arch=source\u0026distro=focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.1.3-2ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.1.3-2",
"3.6.1.3-2ubuntu1",
"3.6.1.3-2ubuntu3",
"3.6.1.3-2ubuntu4",
"3.6.1.3-2ubuntu5"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2021-22569",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2021-22570",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2022-1941",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:22.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "elpa-protobuf-mode",
"binary_version": "3.12.4-1ubuntu7.22.04.1"
},
{
"binary_name": "libprotobuf-java",
"binary_version": "3.12.4-1ubuntu7.22.04.1"
},
{
"binary_name": "libprotobuf-lite23",
"binary_version": "3.12.4-1ubuntu7.22.04.1"
},
{
"binary_name": "libprotobuf23",
"binary_version": "3.12.4-1ubuntu7.22.04.1"
},
{
"binary_name": "libprotoc23",
"binary_version": "3.12.4-1ubuntu7.22.04.1"
},
{
"binary_name": "protobuf-compiler",
"binary_version": "3.12.4-1ubuntu7.22.04.1"
},
{
"binary_name": "python3-protobuf",
"binary_version": "3.12.4-1ubuntu7.22.04.1"
},
{
"binary_name": "ruby-google-protobuf",
"binary_version": "3.12.4-1ubuntu7.22.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "protobuf",
"purl": "pkg:deb/ubuntu/protobuf@3.12.4-1ubuntu7.22.04.1?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.4-1ubuntu7.22.04.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.4-1ubuntu3",
"3.12.4-1ubuntu5",
"3.12.4-1ubuntu6",
"3.12.4-1ubuntu7"
]
}
],
"aliases": [],
"details": "It was discovered that Protocol Buffers did not properly validate field\ncom.google.protobuf.UnknownFieldSet in protobuf-java. An attacker could\npossibly use this issue to perform a denial of service attack. This issue\nonly affected protobuf Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2021-22569)\n\nIt was discovered that Protocol Buffers did not properly parse certain\nsymbols. An attacker could possibly use this issue to cause a denial of\nservice or other unspecified impact. (CVE-2021-22570)\n\nIt was discovered that Protocol Buffers did not properly manage memory when\nparsing specifically crafted messages. An attacker could possibly use this\nissue to cause applications using protobuf to crash, resulting in a denial\nof service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-1941)\n",
"id": "USN-5945-1",
"modified": "2026-06-29T10:53:00Z",
"published": "2023-03-13T06:07:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-5945-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-22569"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-22570"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2022-1941"
}
],
"related": [],
"schema_version": "1.7.0",
"summary": "protobuf vulnerabilities",
"upstream": [
"UBUNTU-CVE-2021-22569",
"UBUNTU-CVE-2021-22570",
"UBUNTU-CVE-2022-1941"
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…