Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - protobuf-c: invalid arithmetic shift via the function parse_tag_and_wiretype may lead to DoS     (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - protobuf-c: invalid arithmetic shift via the function parse_tag_and_wiretype may lead to DoS     (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-086 advisory.

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5811-1 advisory.

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

  - In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-     provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append     arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected     versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a
    -- argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
    (CVE-2023-22809)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of protobuf-c installed on the remote host is prior to 1.4.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-248 advisory.

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5531-1 advisory.

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
200016	RHEL 9 : protobuf-c (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199997	RHEL 8 : protobuf-c (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
173124	Amazon Linux 2023 : protobuf-c, protobuf-c-compiler, protobuf-c-devel (ALAS2023-2023-086)	Nessus	Amazon Linux Local Security Checks	medium
170178	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Sudo vulnerabilities (USN-5811-1)	Nessus	Ubuntu Local Security Checks	high
169367	EulerOS Virtualization 2.10.0 : sudo (EulerOS-SA-2022-2921)	Nessus	Huawei Local Security Checks	critical
169359	EulerOS Virtualization 2.10.1 : sudo (EulerOS-SA-2022-2947)	Nessus	Huawei Local Security Checks	critical
168569	Amazon Linux 2022 : protobuf-c (ALAS2022-2022-248)	Nessus	Amazon Linux Local Security Checks	medium
166850	EulerOS 2.0 SP10 : sudo (EulerOS-SA-2022-2701)	Nessus	Huawei Local Security Checks	critical
166840	EulerOS 2.0 SP10 : sudo (EulerOS-SA-2022-2669)	Nessus	Huawei Local Security Checks	critical
163469	Ubuntu 20.04 LTS / 22.04 LTS : protobuf-c vulnerability (USN-5531-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2022-33070

medium

Tenable Plugins

medium

medium

medium

high

critical

critical

medium

critical

critical

medium