CVE-2022-3171 - Denial of Service

Abstract

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

The Oxygen products incorporate protobuf as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2022-3171

Severity: High

CVSS Score: 7.5

The protobuf third-party library used by Oxygen XML products is an affected version mentioned in CVE-2022-3171 vulnerability description. However, the Oxygen products does not read arbitrary data in protobuf format. For that reason, Oxygen XML products are not affected by this vulnerability.

Starting with Oxygen XML Web Author v25.0.0.1 build 2022111708 protobuf library was updated to a newer version which fixes this vulnerability.