PT-2019-14260 · Rust · Protobuf
Published
2019-06-08
·
Updated
2021-09-14
·
CVE-2019-15544
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
protobuf crate versions prior to 2.6.0
Description
An issue in the protobuf crate allows attackers to exhaust all memory via
Vec::reserve calls. This occurs because affected versions of the crate called Vec::reserve() on user-supplied input, enabling an attacker to cause an Out of Memory condition when the vulnerable method is called on untrusted data.Recommendations
For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
Vec::reserve method on untrusted input until a patch is applied.Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Protobuf