Log in Start free

Vulnerability · Published Jun 22, 2022 · Assigned by mitre

CVE-2022-33070

Medium 5.5

In plain English

A medium-severity security flaw in the protobuf-c package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)1.1%top 33.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20protobuf-c1.4.1-r0ALPINE-CVE-2022-33070
Alpine:v3.21protobuf-c1.4.1-r0ALPINE-CVE-2022-33070
Alpine:v3.22protobuf-c1.4.1-r0ALPINE-CVE-2022-33070
Alpine:v3.23protobuf-c1.4.1-r0ALPINE-CVE-2022-33070
Alpine:v3.24protobuf-c1.4.1-r0ALPINE-CVE-2022-33070
Debian:12protobuf-c1.4.1-1DEBIAN-CVE-2022-33070
Debian:13protobuf-c1.4.1-1DEBIAN-CVE-2022-33070
Debian:14protobuf-c1.4.1-1DEBIAN-CVE-2022-33070
Ubuntu:22.04:LTSargyllno fix listedUBUNTU-CVE-2022-33070
Ubuntu:24.04:LTSargyllno fix listedUBUNTU-CVE-2022-33070
Ubuntu:25.10argyllno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.04:LTSargyllno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.10argyllno fix listedUBUNTU-CVE-2022-33070
Ubuntu:22.04:LTSccextractorno fix listedUBUNTU-CVE-2022-33070
Ubuntu:24.04:LTSccextractorno fix listedUBUNTU-CVE-2022-33070
Ubuntu:22.04:LTSlibgaduno fix listedUBUNTU-CVE-2022-33070
Ubuntu:24.04:LTSlibgaduno fix listedUBUNTU-CVE-2022-33070
Ubuntu:25.10libgaduno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.04:LTSlibgaduno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.10libgaduno fix listedUBUNTU-CVE-2022-33070
Ubuntu:22.04:LTSlibpg-queryno fix listedUBUNTU-CVE-2022-33070
Ubuntu:24.04:LTSlibpg-queryno fix listedUBUNTU-CVE-2022-33070
Ubuntu:25.10libpg-queryno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.04:LTSlibpg-queryno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.10libpg-queryno fix listedUBUNTU-CVE-2022-33070
Ubuntu:22.04:LTSlibsignal-protocol-cno fix listedUBUNTU-CVE-2022-33070
Ubuntu:24.04:LTSlibsignal-protocol-cno fix listedUBUNTU-CVE-2022-33070
Ubuntu:25.10libsignal-protocol-cno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.04:LTSlibsignal-protocol-cno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.10libsignal-protocol-cno fix listedUBUNTU-CVE-2022-33070
Ubuntu:22.04:LTSocservno fix listedUBUNTU-CVE-2022-33070
Ubuntu:24.04:LTSocservno fix listedUBUNTU-CVE-2022-33070
Ubuntu:25.10ocservno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.04:LTSocservno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.10ocservno fix listedUBUNTU-CVE-2022-33070
Ubuntu:22.04:LTSpidginno fix listedUBUNTU-CVE-2022-33070
Ubuntu:24.04:LTSpidginno fix listedUBUNTU-CVE-2022-33070
Ubuntu:25.10pidginno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.04:LTSpidginno fix listedUBUNTU-CVE-2022-33070
Ubuntu:26.10pidginno fix listedUBUNTU-CVE-2022-33070
Ubuntu:22.04:LTSprotobuf-c1.3.3-1ubuntu2.1USN-5531-1
Ubuntu:22.04:LTSprotobuf-c1.3.3-1ubuntu2.1UBUNTU-CVE-2022-33070
Ubuntu:22.04:LTSsudo1.9.9-1ubuntu2.2USN-5811-1
Ubuntu:22.04:LTSsudo1.9.9-1ubuntu2.2UBUNTU-CVE-2022-33070

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References