HIGH7.5
GHSA-mh6h-f25p-98f8
Uncontrolled memory consumption in protobuf
Details
Affected versions of this crate called Vec::reserve() on user-supplied input. This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/protobuf
Introduced in:
0Fixed in: 2.6.0Upgrade protobuf to 2.6.0 or newer (ecosystem crates.io).
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-15544[ADVISORY]
- https://github.com/stepancheg/rust-protobuf/issues/411[WEB]
- https://github.com/stepancheg/rust-protobuf[PACKAGE]
- https://lists.apache.org/thread.html/r00097d0b5b6164ea428554007121d5dc1f88ba2af7b9e977a10572cd@%3Cdev.hbase.apache.org%3E[WEB]
- https://lists.apache.org/thread.html/r4ef574a5621b0e670a3ce641e9922543e34f22bf4c9ee9584aa67fcf@%3Cissues.hbase.apache.org%3E[WEB]
- https://lists.apache.org/thread.html/r7fed8dd9bee494094e7011cf3c2ab75bd8754ea314c6734688c42932@%3Ccommon-issues.hadoop.apache.org%3E[WEB]
- https://lists.apache.org/thread.html/rd64381fb8f92d640c1975dc50dcdf1b8512e02a2a7b20292d3565cae@%3Cissues.hbase.apache.org%3E[WEB]
- https://rustsec.org/advisories/RUSTSEC-2019-0003.html[WEB]