CVE-2021-22570
Last modified
CVE-2021-22570 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. EPSS estimates a 2.66% chance of exploitation in the next 30 days.
Description
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Protobuf | < 3.15.0 | |
| Debian | Debian Linux | 9.0 |
| Debian | Debian Linux | 10.0 |
| Debian | Debian Linux | 11.0 |
| Fedoraproject | Fedora | 34 |
| Fedoraproject | Fedora | 35 |
| Fedoraproject | Fedora | 36 |
| Oracle | Mysql | <= 8.0.28 |
| Netapp | Active Iq Unified Manager | All versions |
| Netapp | Oncommand Insight | All versions |
| Netapp | Oncommand Workflow Automation | All versions |
| Netapp | Snapcenter | All versions |
References
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0Release Notes, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220429-0005/Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlThird Party Advisory
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0Release Notes, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220429-0005/Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-22570?
How severe is CVE-2021-22570?
How do I fix CVE-2021-22570?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-22565An attacker could prematurely expire a verification code, ma…6.5
- CVE-2021-22566An incorrect setting of UXN bits within mmu_flags_to_s1_pte_…9.8
- CVE-2021-22567Bidirectional Unicode text can be interpreted and compiled d…3.5
- CVE-2021-22568When using the dart pub publish command to publish a package…8.8
- CVE-2021-22569An issue in protobuf-java allowed the interleaving of com.go…5.5
- CVE-2021-2257Vulnerability in the Oracle Storage Cloud Software Appliance…4.1
- CVE-2021-22571A local attacker could read files from some other users' SA3…5.5
- CVE-2021-22572On unix-like systems, the system temporary directory is shar…5.5
- CVE-2021-22573The vulnerability is that IDToken verifier does not verify i…7.3
- CVE-2021-2258Vulnerability in the Oracle Projects product of Oracle E-Bus…8.1
- CVE-2021-2259Vulnerability in the Oracle Payables product of Oracle E-Bus…8.1
- CVE-2021-2260Vulnerability in the Oracle Human Resources product of Oracl…8.1
Are you affected by CVE-2021-22570?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST