What is CVE-2022-3171?

CVE-2022-3171 is a vulnerability in certain versions of protobuf-java, a widely used data serialization library. Rated as moderate to high severity, it can lead to denial of service attacks. The vulnerability affects protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3, as well as specific packages in Java, Kotlin, and JRuby environments. Users are advised to update their software to mitigate the risk.

Who is impacted by this?

Users of protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3 are affected. This includes specific packages in Java, Kotlin, and JRuby environments. The vulnerability can lead to denial of service attacks, making systems unresponsive or slow.

What should I do if I’m affected?

If you're affected by CVE-2022-3171, follow these steps to mitigate the risk:

1. Update your protobuf-java, protobuf-javalite, protobuf-kotlin, protobuf-kotlin-lite, and google-protobuf (JRuby gem only) packages to the latest versions.

2. Regenerate any checked-in generated code using the updated version.

These steps will help secure your systems against denial of service attacks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2022-3171 is not listed in CISA's Known Exploited Vulnerabilities Catalog. However, to address this vulnerability, users should update their protobuf-java core and lite versions to 3.21.7, 3.20.3, 3.19.6, or 3.16.3.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-20, which involves improper input validation in protobuf-java.

Learn More

For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the sources below.

• NVD - CVE-2022-3171

• A potential Denial of Service issue in protobuf-java · Advisory · protocolbuffers/protobuf · GitHub

• Fedora 37 Update: protobuf-3.19.6-1.fc37 - package-announce - Fedora Mailing-Lists

• Fedora 36 Update: perl-Alien-ProtoBuf-0.09-17.fc36 - package-announce - Fedora Mailing-Lists

• protobuf-java: Denial of Service (GLSA 202301-09) — Gentoo security