p PatchFirst

CVE-2021-22570

CVE-2021-22570 · Nullptr Dereference in Protobuf

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

CVSS 6.5 · Medium · EPSS 2.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • protobuf

    Versions
    • ≥ unspecified, < 3.15.0: Affected (custom)

    Update to 3.15.0

  • protobuf Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.21.9-3

    Update to 3.21.9-3

  • protobuf Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.21.9-3

    Update to 3.21.9-3

  • protobuf Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.21.9-3

    Update to 3.21.9-3

  • protobuf PyPI

    Versions
    • 2.0.0beta
    • 2.0.3
    • 2.3.0
    • 2.4.1
    • 2.5.0
    • 2.6.0
    • 2.6.1
    • 3.0.0
    • 3.0.0a2
    • 3.0.0a3
    • 3.0.0b1
    • 3.0.0b1.post1
    • 3.0.0b1.post2
    • 3.0.0b2
    • 3.0.0b2.post1
    • 3.0.0b2.post2
    • 3.0.0b3
    • 3.0.0b4
    • 3.1.0
    • 3.1.0.post1
    • 3.10.0
    • 3.10.0rc1
    • 3.11.0
    • 3.11.0rc1
    • 3.11.0rc2
    • 3.11.1
    • 3.11.2
    • 3.11.3
    • 3.12.0
    • 3.12.0rc1
    • 3.12.0rc2
    • 3.12.1
    • 3.12.2
    • 3.12.4
    • 3.13.0
    • 3.13.0rc3
    • 3.14.0
    • 3.14.0rc1
    • 3.14.0rc2
    • 3.14.0rc3
    • 3.15.0rc1
    • 3.15.0rc2
    • 3.2.0
    • 3.2.0rc1
    • 3.2.0rc1.post1
    • 3.2.0rc2
    • 3.3.0
    • 3.4.0
    • 3.5.0.post1
    • 3.5.1
    • 3.5.2
    • 3.5.2.post1
    • 3.6.0
    • 3.6.1
    • 3.7.0
    • 3.7.0rc2
    • 3.7.0rc3
    • 3.7.1
    • 3.8.0
    • 3.8.0rc1
    • 3.9.0
    • 3.9.0rc1
    • 3.9.1
    • 3.9.2
    Affected ranges
    • ECOSYSTEM: < 3.15.0

    Update to 3.15.0

  • protobuf Ubuntu:Pro:14.04:LTS

    Versions
    • 2.4.1-3ubuntu2
    • 2.4.1-3ubuntu3
    • 2.4.1-3ubuntu4
    • 2.5.0-5ubuntu2
    • 2.5.0-7ubuntu1
    • 2.5.0-8ubuntu1
    • 2.5.0-9ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.5.0-9ubuntu1+esm1

    Update to 2.5.0-9ubuntu1+esm1

  • protobuf Ubuntu:Pro:16.04:LTS

    Versions
    • 2.6.1-1.2
    • 2.6.1-1.3
    Affected ranges
    • ECOSYSTEM: < 2.6.1-1.3ubuntu0.1~esm1

    Update to 2.6.1-1.3ubuntu0.1~esm1

  • protobuf Ubuntu:18.04:LTS

    Versions
    • 3.0.0-9ubuntu5
    • 3.0.0-9ubuntu6
    • 3.0.0-9.1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 3.0.0-9.1ubuntu1.1

    Update to 3.0.0-9.1ubuntu1.1

  • protobuf Ubuntu:20.04:LTS

    Versions
    • 3.6.1.3-2
    • 3.6.1.3-2ubuntu1
    • 3.6.1.3-2ubuntu3
    • 3.6.1.3-2ubuntu4
    • 3.6.1.3-2ubuntu5
    Affected ranges
    • ECOSYSTEM: < 3.6.1.3-2ubuntu5.2

    Update to 3.6.1.3-2ubuntu5.2

  • protobuf Ubuntu:22.04:LTS

    Versions
    • 3.12.4-1ubuntu3
    • 3.12.4-1ubuntu5
    • 3.12.4-1ubuntu6
    • 3.12.4-1ubuntu7
    Affected ranges
    • ECOSYSTEM: < 3.12.4-1ubuntu7.22.04.1

    Update to 3.12.4-1ubuntu7.22.04.1

Original sources

Check your server →