Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of protobuf-c installed on the remote host is prior to 1.0.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2619 advisory.

    Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202408-33 (protobuf-c: Multiple Vulnerabilities)

    Multiple denial of service vulnerabilities have been discovered in protobuf-c.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the protobuf package has been released.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-086 advisory.

    A flaw was found in protobuf-c. The issue occurs due to an invalid arithmetic shift via the     parse_tag_and_wiretype in the protobuf-c/protobuf-c.c function. This flaw allows attackers to cause a     denial of service (DoS) via unspecified vectors. (CVE-2022-33070)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5811-1 advisory.

    Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly handled user-specified editors when     using the sudoedit command. A local attacker that has permission to use the sudoedit command could     possibly use this issue to edit arbitrary files. (CVE-2023-22809)

    It was discovered that the Protobuf-c library, used by Sudo, incorrectly handled certain arithmetic     shifts. An attacker could possibly use this issue to cause Sudo to crash, resulting in a denial of     service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-33070)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of protobuf-c installed on the remote host is prior to 1.4.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-248 advisory.

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function     parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via unspecified vectors. (CVE-2022-33070)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5531-1 advisory.

    Pietro Borrello discovered that protobuf-c contained an invalid arithmetic shift. This vulnerability     allowed attackers to cause a denial of service (system crash) via unspecified vectors (CVE-2022-33070).

    It was discovered that protobuf-c contained an unsigned integer overflow. This vulnerability allowed     attackers to cause a denial of service (system crash) via unspecified vectors.

    Todd Miller discovered that protobuf-c contained a possible NULL dereference. This could cause a     vulnerability that allowed attackers to cause a denial of service (system crash) via unspecified vectors.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224764	Linux Distros Unpatched Vulnerability : CVE-2022-33070	Nessus	Misc.	medium
205714	Amazon Linux 2 : protobuf-c (ALAS-2024-2619)	Nessus	Amazon Linux Local Security Checks	medium
205521	GLSA-202408-33 : protobuf-c: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
203538	Photon OS 5.0: Protobuf PHSA-2023-5.0-0022	Nessus	PhotonOS Local Security Checks	medium
203270	Photon OS 4.0: Protobuf PHSA-2023-4.0-0391	Nessus	PhotonOS Local Security Checks	medium
173124	Amazon Linux 2023 : protobuf-c, protobuf-c-compiler, protobuf-c-devel (ALAS2023-2023-086)	Nessus	Amazon Linux Local Security Checks	medium
170178	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Sudo vulnerabilities (USN-5811-1)	Nessus	Ubuntu Local Security Checks	high
169367	EulerOS Virtualization 2.10.0 : sudo (EulerOS-SA-2022-2921)	Nessus	Huawei Local Security Checks	critical
169359	EulerOS Virtualization 2.10.1 : sudo (EulerOS-SA-2022-2947)	Nessus	Huawei Local Security Checks	critical
168569	Amazon Linux 2022 : protobuf-c (ALAS2022-2022-248)	Nessus	Amazon Linux Local Security Checks	medium
166850	EulerOS 2.0 SP10 : sudo (EulerOS-SA-2022-2701)	Nessus	Huawei Local Security Checks	critical
166840	EulerOS 2.0 SP10 : sudo (EulerOS-SA-2022-2669)	Nessus	Huawei Local Security Checks	critical
163469	Ubuntu 20.04 LTS / 22.04 LTS : protobuf-c vulnerability (USN-5531-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2022-33070

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

critical

critical

medium

critical

critical

medium