Skip to content
OpenAdvisories
Medium ALAS2023-2023-009 1 CVE

Moderate: protobuf security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 23, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-22570: A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute unauthorized code or commands, read memory, modify memory.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2023 protobuf 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-compiler 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-compiler-debuginfo 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-debuginfo 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-debugsource 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-devel 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-emacs 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-lite 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-lite-debuginfo 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-lite-devel 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-lite-static 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-static 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 protobuf-vim 0:3.14.0-7.amzn2023.0.3
Amazon Linux · 2023 python3-protobuf 0:3.14.0-7.amzn2023.0.3

Vulnerabilities 1

  • Medium 6.5
    CVE-2021-22570

    Nullptr Dereference in Protobuf

    Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is …

    Google Protobuf mysql druid Debian Ubuntu Azure Linux Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-22570.html