Bug 2313454 (CVE-2024-7254)

Summary: CVE-2024-7254 protobuf: StackOverflow vulnerability in Protocol Buffers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aarif, aazores, adistefa, adudiak, adupliak, agarcial, anli, anpicker, anstephe, aoconnor, aprice, aschwart, asegurap, asoldano, ataylor, avibelli, bbaranow, bbrownin, bbuckingham, bdettelb, bgeorges, bihu, bmaxwell, boliveir, brian.stansberry, brking, caswilli, ccranfor, cdaley, cdewolf, chazlett, chfoley, ckandaga, clement.escoffier, cmah, cmiranda, dandread, darran.lofthouse, dbosanac, dbruscin, dfreiber, dhanak, dkreling, dkuc, dnakabaa, doconnor, dosoudil, drichtar, drow, dsimansk, eaguilar, ebaron, ecerquei, eglynn, ehelms, eric.wittmann, fjansen, fjuma, fmariani, fmongiar, ggainey, gkamathe, gmalinko, gsmet, gtanzill, haoli, hasun, hkataria, ibek, istudens, ivassile, iweiss, janstey, jburrell, jcammara, jcantril, jchui, jeder, jforrest, jjoyce, jkang, jkoehler, jkoops, jmartisk, jmitchel, jneedle, jnethert, jolong, jowilson, jpallich, jpechane, jpoth, jreimann, jrokos, jross, jsamir, jschluet, jscholz, jsherril, jtanner, juwatts, jwong, kaycoth, kgaikwad, kholdawa, kingland, kshier, ktsao, kvanderr, kverlaen, lcouzens, lgamliel, lgao, lhh, lphiri, lsurette, lsvaty, lthon, luizcosta, mabashia, manderse, matzew, mburns, mdessi, mgarciac, mhulan, michal.skrivanek, mkleinhe, mminar, mnovotny, mosmerov, mperina, mpierce, mposolda, mrizzi, mskarbek, msochure, msvehla, mulliken, nboldt, nipatil, nmoumoul, nwallace, nweather, nyancey, oezr, olubyans, omaciel, ometelka, orabin, pantinor, pbraun, pcattana, pcongius, pcreech, pdelbell, pdrozd, peholase, pesilva, pgallagh, pgrist, pierdipi, pjindal, pmackay, probinso, psegedy, pskopek, ptisnovs, pvasanth, rbiba, rbobbitt, rchan, rfreiman, rguimara, rhuss, rkieley, rkubis, rmartinc, rochandr, rojacob, rowaters, rruss, rstancel, rstepani, rsvoboda, rtaniwa, saroy, sausingh, sbiarozk, sbonazzo, sdawley, sdouglas, sfroberg, simaishi, smaestri, smcdonal, ssilvert, sskracic, stcannon, sthirugn, sthorger, swoodman, syedriko, tcunning, teagle, tfister, thavo, tkral, tom.jenkinson, tqvarnst, vkrizan, vkumar, vmugicag, vmuzikar, wfink, wzheng, xdharmai, yfang, yguenane, zkayyali
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2313473, 2313474, 2313475, 2313476, 2313477, 2313517, 2313518, 2313519, 2313520, 2313521    
Bug Blocks:    

Description OSIDB Bzimport 2024-09-19 01:20:54 UTC 
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.
Comment 1 errata-xmlrpc 2024-10-10 14:00:27 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel for Quarkus 2.13

Via RHSA-2024:7972 https://access.redhat.com/errata/RHSA-2024:7972
Comment 2 errata-xmlrpc 2024-11-13 16:21:10 UTC 
This issue has been addressed in the following products:

  Streams for Apache Kafka 2.8.0

Via RHSA-2024:9571 https://access.redhat.com/errata/RHSA-2024:9571
Comment 10 errata-xmlrpc 2025-05-14 16:05:45 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss EAP XP 5.0 Update 2.0

Via RHSA-2025:7620 https://access.redhat.com/errata/RHSA-2025:7620