CVE-2021-22570
Nullptr Dereference in Protobuf
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jan 26, 2022
- Updated
- Apr 21, 2025
- Reserved
- Jan 5, 2021
Description
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Weaknesses
- CWE-476 NULL Pointer Dereference
Affected Products
| Product | Versions |
|---|---|
ProtobufGoogle LLC |
|
References
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0
- FEDORA-2022-ffe4a1ceddvendor-advisory
- FEDORA-2022-2d3e6eb9e4vendor-advisory
- FEDORA-2022-fedff53e4evendor-advisory
- FEDORA-2022-486d5f349dvendor-advisory
- FEDORA-2022-d1a15f9cdbvendor-advisory
- FEDORA-2022-49b52819a4vendor-advisory
- FEDORA-2022-57923346cfvendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220429-0005/
- [debian-lts-announce] 20230418 [SECURITY] [DLA 3393-1] protobuf security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.