x/vulndb: potential Go vuln in github.com/protocolbuffers/protobuf: CVE-2022-1941

[GoVulnBot]

CVE-2022-1941 references github.com/protocolbuffers/protobuf, which may be a Go module.

Description:
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-1941
• JSON: https://github.com/CVEProject/cvelist/tree/26322a0c5011d12522730da0640c89a2f7cb6947/2022/1xxx/CVE-2022-1941.json
• web: https://cloud.google.com/support/bulletins#GCP-2022-019
• fix: GHSA-8gq9-2x98-w8hf
• Imported by: https://pkg.go.dev/github.com/protocolbuffers/protobuf?tab=importedby

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/protocolbuffers/protobuf
    packages:
      - package: protobuf-cpp
description: |
    A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.
cves:
  - CVE-2022-1941
credit: CluterFuzz - https://google.github.io/clusterfuzz/
references:
  - web: https://cloud.google.com/support/bulletins#GCP-2022-019
  - fix: https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf

[gopherbot]

Change https://go.dev/cl/433438 mentions this issue: data/excluded: add GO-2022-1016.yaml for CVE-2022-1941