Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed. This is fixed in versions 0.3.9.7 and 0.4.4. The following workarounds are available: 1) Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. 2) Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed. 3) Use an arena allocator for nanopb, to make sure all memory can be released afterwards.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7,
    decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field
    contains a static submessage that contains a dynamic field, and the message being decoded contains the
    submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is
    parsed. This is fixed in versions 0.3.9.7 and 0.4.4. The following workarounds are available: 1) Set the
    option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and
    avoids triggering the problematic code. 2) Set the type of the submessage field inside oneof to
    `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not
    executed. 3) Use an arena allocator for nanopb, to make sure all memory can be released afterwards.
    (CVE-2020-26243)

The remote Ubuntu 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6121-1 advisory.

    It was discovered that Nanopb incorrectly handled certain decode messages. An attacker could possibly use     this cause a denial of service or expose sensitive information. (CVE-2020-26243)

    It was discovered that Nanopb incorrectly handled certain decode messages. An attacker could possibly use     this issue to cause a denial of service or execute arbitrary code. (CVE-2021-21401)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
412451	SCA: security update for nanopb (GHSA-85rr-4rh9-hhwh)	Tenable Cloud Security	SCA Checks	high
412451	SCA: security update for nanopb (GHSA-85rr-4rh9-hhwh)	Tenable Self-Hosted Container Security	SCA Checks	high
176490	Ubuntu 20.04 ESM : Nanopb vulnerabilities (USN-6121-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2020-26243

high

Tenable Plugins

high

high

high