PT-2023-3201 · Unknown+8 · Protobuf-C+8

Bowlofeggs · Published 2022-07-12 · Updated 2026-02-24 · CVE-2022-48468

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions protobuf-c versions prior to 1.4.1

Description The issue is related to an unsigned integer overflow in the parse required member() function of the protobuf-c protocol serialization data. This can be exploited by a remote attacker to execute arbitrary code, potentially leading to full system compromise.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the parse required member() function until a patch is available.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2023:6621

ALSA-2023:6944

ALT-PU-2022-2228

AZL-26159

BDU:2023-03313

CESA-2023_6944

CVE-2022-48468

INFSA-2023_6621

OESA-2023-1255

OESA-2023-1256

OPENSUSE-SU-2024:12885-1

OPENSUSE-SU-2026:10244-1

RHSA-2023:6621

RHSA-2023:6944

RHSA-2023_6621

RHSA-2023_6944

RHSA-2024:0406

RHSA-2024:3812

ROSA-SA-2024-2397

SUSE-SU-2023:1979-1

SUSE-SU-2023:2143-1

SUSE-SU-2023_1979-1

SUSE-SU-2023_2143-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Red Hat

Red Os

Suse

Protobuf-C

References · 50

• https://github.com/protobuf-c/protobuf-c/issues/499 · Patch
• https://github.com/protobuf-c/protobuf-c/releases/tag/v1.4.1 · Patch
• https://github.com/protobuf-c/protobuf-c/pull/513 · Patch
• https://github.com/protobuf-c/protobuf-c/commit/ec3d900001a13ccdaa8aef996b34c61159c76217 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2023:2143-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0212SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1979-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2023-6944.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48468 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1255 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03313 · Security Note
• https://osv.dev/vulnerability/AZL-26159 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48468 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/EI4JZSHJXW7WOOTAQSV5SUCC5GE2GC2B · Vendor Advisory