Description
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Protocolbuffers | 3.21.7 – < 3.21.7, 3.20.3 – < 3.20.3, 3.19.6 – < 3.19.6, 3.16.3 – < 3.16.3 | 3.21.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | protobuf | 3.21.9-3 | — |
| Debian 13 | protobuf | 3.21.9-3 | — |
| Debian 12 | protobuf | 3.21.9-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | protobuf | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | protobuf | No fix yet | — |
| Ubuntu Pro 18.04 LTS | protobuf | No fix yet | — |
| Ubuntu Pro 16.04 LTS | protobuf | No fix yet | — |
| Ubuntu Pro 14.04 LTS | protobuf | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP5 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLES 15 SP4 | python-Deprecated | 1.2.13-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-PyGithub | 1.43.5-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-aiocontextvars | 0.2.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-avro | 1.11.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-cryptography-vectors | 3.3.2-150100.3.11.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-opencensus | 0.8.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-opencensus-context +1 | 0.1.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-opentelemetry-api | 1.5.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-websockets | 9.1-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP4 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLES 15 SP3 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-Deprecated | 1.2.13-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-PyGithub | 1.43.5-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-aiocontextvars | 0.2.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-avro | 1.11.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-opencensus | 0.8.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-opencensus-context +1 | 0.1.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-opentelemetry-api | 1.5.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-websockets | 9.1-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP3 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLES 15 SP2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-Deprecated | 1.2.13-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-PyGithub | 1.43.5-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-aiocontextvars | 0.2.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-avro | 1.11.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-opencensus +1 | 0.8.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-opencensus-context +1 | 0.1.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-opentelemetry-api | 1.5.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-pytest | 3.10.1-150000.7.5.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-websockets | 9.1-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | grpc | 1.25.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | protobuf | 3.9.2-150100.8.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-Deprecated | 1.2.13-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-PyGithub | 1.43.5-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-Twisted | 17.9.0-150000.3.8.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-avro | 1.11.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-cryptography | 3.3.2-150100.7.15.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-cryptography-vectors | 3.3.2-150100.3.11.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-google-api-core | 1.14.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-googleapis-common-protos | 1.6.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-grpcio-gcp +1 | 0.2.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-opencensus +1 | 0.8.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-opencensus-context +1 | 0.1.2-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-opentelemetry-api | 1.5.0-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-pytest | 3.10.1-150000.7.5.1 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-websockets | 9.1-150100.3.3.3 | SUSE-SU-2023:2783-1 |
| SLES 15 SP1 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
Show 22 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP3 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLES for SAP 15 SP2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | protobuf | 3.9.2-150100.8.3.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-Twisted | 17.9.0-150000.3.8.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-cryptography | 3.3.2-150100.7.15.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLES for SAP 15 SP1 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLE Real Time 15 SP3 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE Micro 5.3 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLE Micro 5.2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLE Micro 5.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLE HPC 15 SP3 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP3 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SLE HPC 15 SP2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | protobuf | 3.9.2-150100.8.3.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | python-cryptography | 3.3.2-150100.7.15.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SLE HPC 15 SP1 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-2, SUSE-SU-2023:2783-1 |
| SUSE Manager Server Module 4.3 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Server Module 4.2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Server Module 4.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Server 4.2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Server 4.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Retail Branch Server 4.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Manager Proxy 4.2 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.2 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Manager Proxy 4.1 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Linux Enterprise Installer Updates 15 SP2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Linux Enterprise Installer Updates 15 SP1 | protobuf | 3.9.2-150100.8.3.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7.1 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| SUSE Enterprise Storage 7 | python-Automat | 0.6.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-incremental | 17.5.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-psutil | 5.9.1-150100.6.6.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-requests | 2.25.1-150100.6.13.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| SUSE Enterprise Storage 7 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | azure-cli-core | 2.17.1-150100.6.18.1 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
| openSUSE Leap 15.4 | python-constantly | 15.1.0-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-humanfriendly | 10.0-150100.6.3.3 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-hyperlink | 17.2.1-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-jsondiff | 1.3.0-150100.3.6.3 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-knack | 0.9.0-150100.3.7.3 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-websocket-client | 1.3.2-150100.6.7.3 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.4 | python-zope.interface | 4.4.2-150000.3.4.1 | SUSE-SU-2023:2783-1 |
| openSUSE Leap 15.3 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.2 | protobuf | 3.9.2-150200.4.19.2 | SUSE-SU-2022:3922-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | protobuf +9 | 3.19.6-1.amzn2023.0.1 | ALAS2023-2023-049 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | celeborn-0.6 | 0.6.3-r7 | — |
| Wolfi rolling | druid | 34.0.0-r6 | — |
| Wolfi rolling | trino +58 | 439-r0 | — |
Affected packages
Advisories 23
- WID-SEC-2023-0126 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2026
- SUSE-SU-2023:2783-2 Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websoc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2783-1 Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websoc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3922-1 Security update for protobuf SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0049 Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-0138 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2022-2187 IBM WebSphere Application Server: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 29, 2025
- WID-SEC-2024-3684 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2024
- WID-SEC-2024-0671 Atlassian Jira Software: Mehrere Schwachstellen ermöglichen Codeausführung und DoS BSI CERT-Bund (WID) · Nov 24, 2024
- WID-SEC-2023-0137 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- WID-SEC-2024-0197 IBM QRadar SIEM: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 24, 2024
- WID-SEC-2023-2700 Atlassian Confluence: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 12, 2023
- WID-SEC-2023-2675 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-1808 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1021 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
- WID-SEC-2023-0132 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2023
- WID-SEC-2023-1031 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-1022 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-1017 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- ALAS2023-2023-049 Important: protobuf security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- WID-SEC-2023-0136 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- WID-SEC-2023-0133 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
References
- https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2
- FEDORA-2022-25f35ed634 vendor-advisory
- GLSA-202301-09 vendor-advisory
- FEDORA-2022-15729fa33d vendor-advisory