What’s Vulnerable › Vulnerabilities
CVE-2021-22570: Nullptr Dereference in Protobuf
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-01-26 · updated 2026-06-17
- Weakness: CWE-476
Description
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Affected products
- Debian Linux: 9.0, 10.0, 11.0
- Fedoraproject Fedora: 34, 35, 36
- Python Protobuf: before 3.15.0 — fixed in 3.15.0
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
- OnCommand Insight: all versions
- NetApp OnCommand Workflow Automation: all versions
- NetApp SnapCenter: all versions
- MySQL Server: through 8.0.28
How to fix
Upgrade to a fixed version: Python Protobuf 3.15.0. Check the vendor advisory for mitigations.
References
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0
- https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DVUZPALAQ34TQP6KFNLM4IZS6B32XSA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BTRGBRC5KGCA4SK5MUNLPYJRAGXMBIYY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFX6KPNOFHYD6L4XES5PCM3QNSKZBOTQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVTWVQRB5OCCTMKEQFY5MYED3DXDVSLP/
- https://security.netapp.com/advisory/ntap-20220429-0005/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/protocolbuffers/protobuf/releases/tag/v3.15.0
Get alerted when CVE-2021-22570 or the next vulnerability affects your stack