Amazon Linux 2023 Security Advisory: ALAS-2023-049
Advisory Release Date: 2023-02-17 20:45 Pacific
Advisory Updated Date: 2023-02-22 23:39 Pacific
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1,
3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against
services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated. (CVE-2022-1941)
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above. (CVE-2022-3171)
Affected Packages:
protobuf
Issue Correction:
Run dnf update protobuf --releasever=2023.0.20230222 to update your system.
aarch64:
protobuf-debuginfo-3.19.6-1.amzn2023.0.1.aarch64
protobuf-lite-devel-3.19.6-1.amzn2023.0.1.aarch64
protobuf-compiler-3.19.6-1.amzn2023.0.1.aarch64
protobuf-devel-3.19.6-1.amzn2023.0.1.aarch64
protobuf-compiler-debuginfo-3.19.6-1.amzn2023.0.1.aarch64
protobuf-lite-static-3.19.6-1.amzn2023.0.1.aarch64
protobuf-3.19.6-1.amzn2023.0.1.aarch64
protobuf-lite-debuginfo-3.19.6-1.amzn2023.0.1.aarch64
protobuf-lite-3.19.6-1.amzn2023.0.1.aarch64
protobuf-static-3.19.6-1.amzn2023.0.1.aarch64
protobuf-debugsource-3.19.6-1.amzn2023.0.1.aarch64
python3-protobuf-3.19.6-1.amzn2023.0.1.aarch64
python3-protobuf-debuginfo-3.19.6-1.amzn2023.0.1.aarch64
noarch:
protobuf-emacs-3.19.6-1.amzn2023.0.1.noarch
protobuf-vim-3.19.6-1.amzn2023.0.1.noarch
src:
protobuf-3.19.6-1.amzn2023.0.1.src
x86_64:
protobuf-debuginfo-3.19.6-1.amzn2023.0.1.x86_64
protobuf-compiler-debuginfo-3.19.6-1.amzn2023.0.1.x86_64
protobuf-lite-debuginfo-3.19.6-1.amzn2023.0.1.x86_64
protobuf-lite-3.19.6-1.amzn2023.0.1.x86_64
protobuf-devel-3.19.6-1.amzn2023.0.1.x86_64
protobuf-3.19.6-1.amzn2023.0.1.x86_64
protobuf-static-3.19.6-1.amzn2023.0.1.x86_64
python3-protobuf-debuginfo-3.19.6-1.amzn2023.0.1.x86_64
protobuf-lite-devel-3.19.6-1.amzn2023.0.1.x86_64
protobuf-debugsource-3.19.6-1.amzn2023.0.1.x86_64
protobuf-lite-static-3.19.6-1.amzn2023.0.1.x86_64
protobuf-compiler-3.19.6-1.amzn2023.0.1.x86_64
python3-protobuf-3.19.6-1.amzn2023.0.1.x86_64