Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

The version of protobuf-c installed on the remote host is prior to 1.0.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2619 advisory.

    Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202408-33 (protobuf-c: Multiple Vulnerabilities)

    Multiple denial of service vulnerabilities have been discovered in protobuf-c.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the protobuf package has been released.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - protobuf-c: invalid arithmetic shift via the function parse_tag_and_wiretype may lead to DoS     (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - protobuf-c: invalid arithmetic shift via the function parse_tag_and_wiretype may lead to DoS     (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-086 advisory.

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5811-1 advisory.

    Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly handled user-specified editors when     using the sudoedit command. A local attacker that has permission to use the sudoedit command could     possibly use this issue to edit arbitrary files. (CVE-2023-22809)

    It was discovered that the Protobuf-c library, used by Sudo, incorrectly handled certain arithmetic     shifts. An attacker could possibly use this issue to cause Sudo to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-33070)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of protobuf-c installed on the remote host is prior to 1.4.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-248 advisory.

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5531-1 advisory.

    Pietro Borrello discovered that protobuf-c contained an invalid arithmetic shift. This vulnerability     allowed attackers to cause a denial of service (system crash) via unspecified vectors (CVE-2022-33070).

    It was discovered that protobuf-c contained an unsigned integer overflow. This vulnerability allowed     attackers to cause a denial of service (system crash) via unspecified vectors.

    Todd Miller discovered that protobuf-c contained a possible NULL dereference. This could cause a     vulnerability that allowed attackers to cause a denial of service (system crash) via unspecified vectors.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205714	Amazon Linux 2 : protobuf-c (ALAS-2024-2619)	Nessus	Amazon Linux Local Security Checks	medium
205521	GLSA-202408-33 : protobuf-c: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
203538	Photon OS 5.0: Protobuf PHSA-2023-5.0-0022	Nessus	PhotonOS Local Security Checks	medium
203270	Photon OS 4.0: Protobuf PHSA-2023-4.0-0391	Nessus	PhotonOS Local Security Checks	medium
200016	RHEL 9 : protobuf-c (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199997	RHEL 8 : protobuf-c (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196349	RHEL 7 : protobuf-c (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
173124	Amazon Linux 2023 : protobuf-c, protobuf-c-compiler, protobuf-c-devel (ALAS2023-2023-086)	Nessus	Amazon Linux Local Security Checks	medium
170178	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Sudo vulnerabilities (USN-5811-1)	Nessus	Ubuntu Local Security Checks	high
169367	EulerOS Virtualization 2.10.0 : sudo (EulerOS-SA-2022-2921)	Nessus	Huawei Local Security Checks	critical
169359	EulerOS Virtualization 2.10.1 : sudo (EulerOS-SA-2022-2947)	Nessus	Huawei Local Security Checks	critical
168569	Amazon Linux 2022 : protobuf-c (ALAS2022-2022-248)	Nessus	Amazon Linux Local Security Checks	medium
166850	EulerOS 2.0 SP10 : sudo (EulerOS-SA-2022-2701)	Nessus	Huawei Local Security Checks	critical
166840	EulerOS 2.0 SP10 : sudo (EulerOS-SA-2022-2669)	Nessus	Huawei Local Security Checks	critical
163469	Ubuntu 20.04 LTS / 22.04 LTS : protobuf-c vulnerability (USN-5531-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2022-33070

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

high

critical

critical

medium

critical

critical

medium