OESA-2022-2012 (CVE-2022-1941)
Vulnerability from osv_openeuler – Published: 2022-10-21 11:05 – Updated: 2026-08-06 11:05 – Source websiteSecurity Fix(es):
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.(CVE-2022-1941)
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.(CVE-2022-3171)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"protobuf-debugsource-3.14.0-6.oe2203.aarch64.rpm",
"protobuf-lite-3.14.0-6.oe2203.aarch64.rpm",
"protobuf-lite-devel-3.14.0-6.oe2203.aarch64.rpm",
"protobuf-debuginfo-3.14.0-6.oe2203.aarch64.rpm",
"protobuf-compiler-3.14.0-6.oe2203.aarch64.rpm",
"protobuf-3.14.0-6.oe2203.aarch64.rpm",
"protobuf-devel-3.14.0-6.oe2203.aarch64.rpm"
],
"noarch": [
"protobuf-java-3.14.0-6.oe2203.noarch.rpm",
"python3-protobuf-3.14.0-6.oe2203.noarch.rpm",
"protobuf-javalite-3.14.0-6.oe2203.noarch.rpm",
"protobuf-parent-3.14.0-6.oe2203.noarch.rpm",
"protobuf-java-util-3.14.0-6.oe2203.noarch.rpm",
"protobuf-javadoc-3.14.0-6.oe2203.noarch.rpm",
"protobuf-bom-3.14.0-6.oe2203.noarch.rpm"
],
"src": [
"protobuf-3.14.0-6.oe2203.src.rpm"
],
"x86_64": [
"protobuf-lite-devel-3.14.0-6.oe2203.x86_64.rpm",
"protobuf-debuginfo-3.14.0-6.oe2203.x86_64.rpm",
"protobuf-3.14.0-6.oe2203.x86_64.rpm",
"protobuf-lite-3.14.0-6.oe2203.x86_64.rpm",
"protobuf-compiler-3.14.0-6.oe2203.x86_64.rpm",
"protobuf-devel-3.14.0-6.oe2203.x86_64.rpm",
"protobuf-debugsource-3.14.0-6.oe2203.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:22.03-LTS",
"name": "protobuf",
"purl": "pkg:rpm/openEuler/protobuf\u0026distro=openEuler-22.03-LTS"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.0-6.oe2203"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "High"
},
"details": "\r\n\r\nSecurity Fix(es):\r\n\r\nA parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.(CVE-2022-1941)\r\n\r\nA parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.(CVE-2022-3171)",
"id": "OESA-2022-2012",
"modified": "2026-08-06T11:05:19Z",
"published": "2022-10-21T11:05:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2012"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1941"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3171"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "protobuf security update",
"upstream": [
"CVE-2022-1941",
"CVE-2022-3171"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.