Security update for protobuf SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:3746-1 Final 1 1 2024-10-22T13:40:55Z current 2024-10-22T13:40:55Z 2024-10-22T13:40:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for protobuf This update for protobuf fixes the following issues: - CVE-2024-7254: Fixed stack overflow vulnerability in Protocol Buffer (bsc#1230778) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP4-BYOS-Azure-2024-3746,Image SLES15-SP4-HPC-BYOS-2024-3746,Image SLES15-SP4-HPC-BYOS-Azure-2024-3746,Image SLES15-SP4-Hardened-BYOS-Azure-2024-3746,Image SLES15-SP4-Manager-Server-4-3-2024-3746,Image SLES15-SP4-Manager-Server-4-3-Azure-llc-2024-3746,Image SLES15-SP4-Manager-Server-4-3-Azure-ltd-2024-3746,Image SLES15-SP4-Manager-Server-4-3-BYOS-2024-3746,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2024-3746,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2024-3746,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2024-3746,Image SLES15-SP4-Manager-Server-4-3-EC2-llc-2024-3746,Image SLES15-SP4-Manager-Server-4-3-EC2-ltd-2024-3746,Image SLES15-SP4-SAP-2024-3746,Image SLES15-SP4-SAP-Azure-2024-3746,Image SLES15-SP4-SAP-BYOS-Azure-2024-3746,Image SLES15-SP4-SAP-Hardened-2024-3746,Image SLES15-SP4-SAP-Hardened-Azure-2024-3746,Image SLES15-SP4-SAP-Hardened-BYOS-Azure-2024-3746,Image SLES15-SP4-SAPCAL-2024-3746,Image SLES15-SP4-SAPCAL-Azure-2024-3746,SUSE-2024-3746,SUSE-SLE-INSTALLER-15-SP4-2024-3746,SUSE-SLE-Micro-5.3-2024-3746,SUSE-SLE-Micro-5.4-2024-3746,SUSE-SLE-Module-Public-Cloud-15-SP4-2024-3746,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3746,SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3746,SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-3746,SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3746,SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3746,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-3746 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20243746-1/ Link for SUSE-SU-2024:3746-1 https://lists.suse.com/pipermail/sle-security-updates/2024-October/019666.html E-Mail link for SUSE-SU-2024:3746-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1230778 SUSE Bug 1230778 https://www.suse.com/security/cve/CVE-2024-7254/ SUSE CVE CVE-2024-7254 page Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3 Image SLES15-SP4-Manager-Server-4-3-Azure-llc Image SLES15-SP4-Manager-Server-4-3-Azure-ltd Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-EC2-llc Image SLES15-SP4-Manager-Server-4-3-EC2-ltd Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Installer Updates 15 SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Manager Server 4.3 python311-protobuf-4.25.1-150400.9.10.1 protobuf-java-25.1-150400.9.10.1 libprotobuf-lite25_1_0-25.1-150400.9.10.1 libprotobuf-lite25_1_0-32bit-25.1-150400.9.10.1 libprotobuf-lite25_1_0-64bit-25.1-150400.9.10.1 libprotobuf25_1_0-25.1-150400.9.10.1 libprotobuf25_1_0-32bit-25.1-150400.9.10.1 libprotobuf25_1_0-64bit-25.1-150400.9.10.1 libprotoc25_1_0-25.1-150400.9.10.1 libprotoc25_1_0-32bit-25.1-150400.9.10.1 libprotoc25_1_0-64bit-25.1-150400.9.10.1 protobuf-devel-25.1-150400.9.10.1 python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-BYOS-Azure python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-HPC-BYOS python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-HPC-BYOS-Azure python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-Hardened-BYOS-Azure protobuf-java-25.1-150400.9.10.1 as a component of Image SLES15-SP4-Manager-Server-4-3 protobuf-java-25.1-150400.9.10.1 as a component of Image SLES15-SP4-Manager-Server-4-3-Azure-llc protobuf-java-25.1-150400.9.10.1 as a component of Image SLES15-SP4-Manager-Server-4-3-Azure-ltd protobuf-java-25.1-150400.9.10.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS protobuf-java-25.1-150400.9.10.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure protobuf-java-25.1-150400.9.10.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 protobuf-java-25.1-150400.9.10.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE protobuf-java-25.1-150400.9.10.1 as a component of Image SLES15-SP4-Manager-Server-4-3-EC2-llc protobuf-java-25.1-150400.9.10.1 as a component of Image SLES15-SP4-Manager-Server-4-3-EC2-ltd python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-SAP python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-SAP-Azure python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-SAP-BYOS-Azure python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-SAP-Hardened python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-SAP-Hardened-Azure python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-Azure python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-SAPCAL python311-protobuf-4.25.1-150400.9.10.1 as a component of Image SLES15-SP4-SAPCAL-Azure libprotobuf-lite25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS libprotobuf25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS libprotoc25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS protobuf-devel-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS libprotobuf-lite25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libprotobuf25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libprotoc25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS protobuf-devel-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libprotobuf-lite25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Installer Updates 15 SP4 libprotobuf-lite25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Micro 5.3 libprotobuf-lite25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Micro 5.4 python311-protobuf-4.25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4 libprotobuf-lite25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libprotobuf25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libprotoc25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS protobuf-devel-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libprotobuf-lite25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libprotobuf25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libprotoc25_1_0-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 protobuf-devel-25.1-150400.9.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libprotobuf-lite25_1_0-25.1-150400.9.10.1 as a component of SUSE Manager Server 4.3 libprotobuf25_1_0-25.1-150400.9.10.1 as a component of SUSE Manager Server 4.3 libprotoc25_1_0-25.1-150400.9.10.1 as a component of SUSE Manager Server 4.3 Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker. CVE-2024-7254 Image SLES15-SP4-BYOS-Azure:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-HPC-BYOS-Azure:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-HPC-BYOS:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-Hardened-BYOS-Azure:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-Manager-Server-4-3-Azure-llc:protobuf-java-25.1-150400.9.10.1 Image SLES15-SP4-Manager-Server-4-3-Azure-ltd:protobuf-java-25.1-150400.9.10.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:protobuf-java-25.1-150400.9.10.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:protobuf-java-25.1-150400.9.10.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:protobuf-java-25.1-150400.9.10.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:protobuf-java-25.1-150400.9.10.1 Image SLES15-SP4-Manager-Server-4-3-EC2-llc:protobuf-java-25.1-150400.9.10.1 Image SLES15-SP4-Manager-Server-4-3-EC2-ltd:protobuf-java-25.1-150400.9.10.1 Image SLES15-SP4-Manager-Server-4-3:protobuf-java-25.1-150400.9.10.1 Image SLES15-SP4-SAP-Azure:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-SAP-BYOS-Azure:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-SAP-Hardened-Azure:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-SAP-Hardened-BYOS-Azure:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-SAP-Hardened:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-SAP:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-SAPCAL-Azure:python311-protobuf-4.25.1-150400.9.10.1 Image SLES15-SP4-SAPCAL:python311-protobuf-4.25.1-150400.9.10.1 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libprotobuf-lite25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libprotobuf25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libprotoc25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:protobuf-devel-25.1-150400.9.10.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libprotobuf-lite25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libprotobuf25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libprotoc25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:protobuf-devel-25.1-150400.9.10.1 SUSE Linux Enterprise Installer Updates 15 SP4:libprotobuf-lite25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise Micro 5.3:libprotobuf-lite25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise Micro 5.4:libprotobuf-lite25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-protobuf-4.25.1-150400.9.10.1 SUSE Linux Enterprise Server 15 SP4-LTSS:libprotobuf-lite25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise Server 15 SP4-LTSS:libprotobuf25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise Server 15 SP4-LTSS:libprotoc25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise Server 15 SP4-LTSS:protobuf-devel-25.1-150400.9.10.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4:libprotobuf-lite25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4:libprotobuf25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4:libprotoc25_1_0-25.1-150400.9.10.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4:protobuf-devel-25.1-150400.9.10.1 SUSE Manager Server 4.3:libprotobuf-lite25_1_0-25.1-150400.9.10.1 SUSE Manager Server 4.3:libprotobuf25_1_0-25.1-150400.9.10.1 SUSE Manager Server 4.3:libprotoc25_1_0-25.1-150400.9.10.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243746-1/ https://www.suse.com/security/cve/CVE-2024-7254.html CVE-2024-7254 https://bugzilla.suse.com/1230778 SUSE Bug 1230778