PT-2019-14260 · Rust · Protobuf
Publicado
2019-06-08
·
Atualizado
2021-09-14
·
CVE-2019-15544
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
protobuf crate versions prior to 2.6.0
Description
An issue in the protobuf crate allows attackers to exhaust all memory via
Vec::reserve calls. This occurs because affected versions of the crate called Vec::reserve() on user-supplied input, enabling an attacker to cause an Out of Memory condition when the vulnerable method is called on untrusted data.Recommendations
For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
Vec::reserve method on untrusted input until a patch is applied.Correção
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Protobuf