Protocol Buffers PHP parser can crash on bad input (USN-8943-1)
Original title: USN-8943-1: Protocol Buffers vulnerability
Ubuntu says negative varint lengths or missing recursion limits can crash apps or exhaust resources.
Ubuntu Security Notice USN-8943-1 says the Protocol Buffers PHP library did not properly handle negative varint lengths or enforce recursion limits while parsing input. An attacker could possibly crash applications that use the library or make them consume resources, causing a denial of service. The notice text does not name a CVE, fixed version, or known exploitation.
- Issue is in the PHP Protocol Buffers library.
- Impact described is crash or resource consumption, a denial of service.
- No fixed version or CVE appears in the notice text.
Impact: denial of service via crash or resource use
| Product | Affected |
|---|---|
| Protocol Buffers PHP library | — |
- 1.Apply Ubuntu security notice USN-8943-1 for the Protocol Buffers PHP library.
- Products
- Protocol Buffers
- Organizations
- Ubuntu
From the original article
It was discovered that Protocol Buffers did not properly handle negative varint lengths or enforce recursion limits when parsing input in the PHP library. An attacker could possibly use this issue to cause applications using Protocol Buffers to crash or consume resources, resulting in a denial of service.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.