Description
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | protobuf | < 2.6.0 | 2.6.0 | GHSA-mh6h-f25p-98f8 |
| crates.io | protobuf | >= 0.0.0-0, < 1.7.5 · >= 2.0.0-0, < 2.6.0 | 1.7.5, 2.6.0 | RUSTSEC-2019-0003 |
References
- https://rustsec.org/advisories/RUSTSEC-2019-0003.html
- [hbase-issues] 20210828 [jira] [Commented] (HBASE-26234) Protobuf-java-2.5.0.jar Has Several Security Vulnerabilities,CVE-2015-5237,CVE-2019-15544 mailing-list
- [hbase-dev] 20210828 [jira] [Created] (HBASE-26234) Protobuf-java-2.5.0.jar Has Several Security Vulnerabilities,CVE-2015-5237,CVE-2019-15544 mailing-list
- [hbase-issues] 20210828 [jira] [Created] (HBASE-26234) Protobuf-java-2.5.0.jar Has Several Security Vulnerabilities,CVE-2015-5237,CVE-2019-15544 mailing-list
- [hadoop-common-issues] 20210902 [jira] [Updated] (HADOOP-17860) Upgrade third party protobuf-java-2.5.0.jar to address vulnerabilities #CVE-2015-5237, CVE-2019-15544 mailing-list