Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN362

_____________________________________________________________________

DATE                : 18/06/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running com-protobuf (RubyGems),
                      protobuf-java (Maven), protobuf-javalite (Maven), 
                 protobuf-kotlin (Maven), protobuf-kotlin-lite (Maven).

=====================================================================
https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8
_____________________________________________________________________

A potential Denial of Service issue in protobuf-java
High
zhangskz published GHSA-735f-pc8j-v9w8 Sep 18, 2024

Package
com-protobuf (RubyGems)

Affected versions
<4.28.2

Patched versions
3.25.5, 4.27.5, 4.28.2

com.google.protobuf:protobuf-java (Maven)
Affected versions
<4.28.2
Patched versions
3.25.5, 4.27.5, 4.28.2

com.google.protobuf:protobuf-javalite (Maven)
<4.28.2
<4.28.2
Patched versions
3.25.5, 4.27.5, 4.28.2
3.25.5, 4.27.5, 4.28.2

com.google.protobuf:protobuf-kotlin (Maven)
Affected versions
<4.28.2
Patched versions
3.25.5, 4.27.5, 4.28.2

com.google.protobuf:protobuf-kotlin-lite (Maven)
Affected versions
<4.28.2
Patched versions
3.25.5, 4.27.5, 4.28.2


Description

Summary

When parsing unknown fields in the Protobuf Java Lite and Full
library, a maliciously crafted message can cause a StackOverflow
error and lead to a program crash.

Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team
ecosystem@trailofbits.com

Affected versions: This issue affects all versions of both the Java
full and lite Protobuf runtimes, as well as Protobuf for Kotlin and
JRuby, which themselves use the Java Protobuf runtime.


Severity

CVE-2024-7254 High CVSS4.0 Score 8.7 (NOTE: there may be a delay in
publication)
This is a potential Denial of Service. Parsing nested groups as
unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite
parser, or against Protobuf map fields, creates unbounded recursions
that can be abused by an attacker.


Proof of Concept

For reproduction details, please refer to the unit tests (Protobuf
Java LiteTest and CodedInputStreamTest) that identify the specific
inputs that exercise this parsing weakness.


Remediation and Mitigation

We have been working diligently to address this issue and have
released a mitigation that is available now. Please update to the
latest available versions of the following packages:

    protobuf-java (3.25.5, 4.27.5, 4.28.2)
    protobuf-javalite (3.25.5, 4.27.5, 4.28.2)
    protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)
    protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)
    com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)


Severity
High

8.2/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required None
User interaction None
Vulnerable System Impact Metrics
Confidentiality None
Integrity None
Availability High
Subsequent System Impact Metrics
Confidentiality None
Integrity None
Availability None
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVE ID
CVE-2024-7254

Weaknesses
No CWEs



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================