Protocol Buffers DoS Vulnerability Patched for Ubuntu LTS Releases
Ubuntu has released security updates addressing a denial-of-service vulnerability in Protocol Buffers affecting the ParseDict() function. The flaw allows attackers to trigger excessive resource consumption through malformed recursive input.
TL;DR
- Protocol Buffers vulnerability enables DoS attacks via ParseDict() recursion handling
- Ubuntu 18.04 LTS and 20.04 LTS now receive corresponding security patches
- Attackers can exhaust system resources by exploiting improper recursion limits
- Update immediately if your applications use google.protobuf.json_format module
Canonical has released security updates for Protocol Buffers addressing a denial-of-service vulnerability that impacts Ubuntu 18.04 LTS and 20.04 LTS systems. The flaw resides in the Python google.protobuf.json_format.ParseDict() function, which fails to properly validate recursion depth when processing structured data.
An attacker can exploit this weakness by crafting malicious Protocol Buffer messages with deeply nested structures, forcing the affected function into excessive recursion. This causes the application to consume abnormal amounts of CPU and memory resources, potentially rendering services unavailable to legitimate users.
Development teams using Protocol Buffers for data serialization should prioritize applying these updates to prevent exploitation in production environments.
Vulnerability Details
- Affects google.protobuf.json_format.ParseDict() function in Python implementations
- Improper recursion handling allows attackers to trigger resource exhaustion
- Denial-of-service impact: applications become unresponsive or crash
- Vulnerability requires no authentication or special privileges to exploit
Affected Systems and Remediation
- Ubuntu 18.04 LTS and Ubuntu 20.04 LTS receive corresponding security patches
- Earlier patch USN-8063-1 addressed the same issue for other Ubuntu versions
- Apply updates immediately to systems running Protocol Buffers libraries
- Verify application dependencies and rebuild containers with patched versions
Mitigation Recommendations
- Prioritize updates for services processing untrusted Protocol Buffer data
- Implement input validation and recursion depth limits in application code
- Monitor for unusual CPU and memory spikes indicating potential exploitation
- Review application logs for ParseDict() errors or performance degradation
Sources
Fontes
Atualizações de segurança por e-mail
Um e-mail resumo quando publicarmos novos artigos de segurança (TL;DR e links para ler mais). Cancele a inscrição a qualquer momento no rodapé da mensagem. Veja nossa Política de Privacidade.