CVE-2021-22569

Denial of Service in gem/google-protobuf

Identifiers

CVE-2021-22569, GHSA-wrvw-hg22-4m67, GMS-2022-1

Package Slug

gem/google-protobuf

Vulnerability

Denial of Service

Description

An issue in protobuf-java (JRuby gem) allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

Affected Versions

All versions before 3.19.2

Solution

Upgrade to version 3.19.2 or above.

Last Modified

2022-01-16

source