Skip to content
OpenAdvisories
Medium ALAS2-2023-1948 1 CVE

Moderate: protobuf security update (Amazon Linux 2)

Published Feb 17, 2023 · Updated Feb 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-22570: A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute unauthorized code or commands, read memory, modify memory.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2 protobuf 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-compiler 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-debuginfo 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-devel 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-emacs 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-emacs-el 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-java 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-javadoc 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-lite 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-lite-devel 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-lite-static 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-python 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-static 0:2.5.0-8.amzn2.0.3
Amazon Linux · 2 protobuf-vim 0:2.5.0-8.amzn2.0.3

Vulnerabilities 1

  • Medium 6.5
    CVE-2021-22570

    Nullptr Dereference in Protobuf

    Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is …

    Google Protobuf mysql druid Debian Ubuntu Azure Linux Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-22570.html