libprotobuf-nanopb0-0.4.5-1.3 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11074-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z libprotobuf-nanopb0-0.4.5-1.3 on GA media These are all security issues fixed in the libprotobuf-nanopb0-0.4.5-1.3 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11074 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2020-26243/ SUSE CVE CVE-2020-26243 page https://www.suse.com/security/cve/CVE-2020-5235/ SUSE CVE CVE-2020-5235 page https://www.suse.com/security/cve/CVE-2021-21401/ SUSE CVE CVE-2021-21401 page openSUSE Tumbleweed libprotobuf-nanopb0-0.4.5-1.3 nanopb-devel-0.4.5-1.3 nanopb-source-0.4.5-1.3 libprotobuf-nanopb0-0.4.5-1.3 as a component of openSUSE Tumbleweed nanopb-devel-0.4.5-1.3 as a component of openSUSE Tumbleweed nanopb-source-0.4.5-1.3 as a component of openSUSE Tumbleweed Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed. This is fixed in versions 0.3.9.7 and 0.4.4. The following workarounds are available: 1) Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. 2) Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed. 3) Use an arena allocator for nanopb, to make sure all memory can be released afterwards. CVE-2020-26243 openSUSE Tumbleweed:libprotobuf-nanopb0-0.4.5-1.3 openSUSE Tumbleweed:nanopb-devel-0.4.5-1.3 openSUSE Tumbleweed:nanopb-source-0.4.5-1.3 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-26243.html CVE-2020-26243 There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is compiled with PB_ENABLE_MALLOC, the message to be decoded contains a repeated string, bytes or message field and realloc() runs out of memory when expanding the array nanopb can end up calling `free()` on a pointer value that comes from uninitialized memory. Depending on platform this can result in a crash or further memory corruption, which may be exploitable in some cases. This problem is fixed in nanopb-0.4.1, nanopb-0.3.9.5, nanopb-0.2.9.4. CVE-2020-5235 openSUSE Tumbleweed:libprotobuf-nanopb0-0.4.5-1.3 openSUSE Tumbleweed:nanopb-devel-0.4.5-1.3 openSUSE Tumbleweed:nanopb-source-0.4.5-1.3 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-5235.html CVE-2020-5235 https://bugzilla.suse.com/1162647 SUSE Bug 1162647 Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds. CVE-2021-21401 openSUSE Tumbleweed:libprotobuf-nanopb0-0.4.5-1.3 openSUSE Tumbleweed:nanopb-devel-0.4.5-1.3 openSUSE Tumbleweed:nanopb-source-0.4.5-1.3 moderate 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-21401.html CVE-2021-21401