{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:26a655a3-abe1-5c69-abd8-26835e7472de", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "protobuf-java", "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12-tuxcare.2", "type": "library", "group": "com.google.protobuf", "bom-ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12-tuxcare.2", "version": "3.21.12-tuxcare.2", "pedigree": { "ancestors": [ { "name": "protobuf-java", "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12", "type": "library", "group": "com.google.protobuf", "version": "3.21.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22569", "affects": [ { "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12-tuxcare.2" } ], "bom-ref": "urn:uuid:74698d74-5bf6-5d72-9949-a19fccfb4c2d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22569 does not affect version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-java. CVE-2021-22569 is not present in protobuf 3.21.12. The vulnerability was a DoS issue in UnknownFieldSet parsing that created excessive short-lived objects causing GC pauses. The fix (commit c555c3dd1) refactored UnknownFieldSet.Builder to use TreeMap instead of the lastField/lastFieldNumber optimization, eliminating repeated Field object creation. This fix was authored by Google's protobuf team (acozzette@google.com) and shipped in upstream protobuf 3.21.12, which TuxCare onboarded. The target code at java/core/src/main/java/com/google/protobuf/UnknownFieldSet.java:308 contains the fixed implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2).", "justification": "code_not_present" } }, { "id": "CVE-2021-22570", "affects": [ { "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12-tuxcare.2" } ], "bom-ref": "urn:uuid:20e98c30-797d-5425-a1f0-23006ea24e92", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-22570 is a false positive for com.google.protobuf:protobuf-java 3.21.12-tuxcare.2." } }, { "id": "CVE-2022-3171", "affects": [ { "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1ca99b79-06c9-5deb-a7a0-3c146705fd01", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-3171 does not affect version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-java. not_affected \u2014 CVE-2022-3171 is NOT present in protobuf 3.21.12. The vulnerability was fixed in upstream protobuf 3.21.7 (commit 3b5301c114 \"Refactoring Java parsing\"), which refactored the parsing logic to merge directly into mutable message objects instead of repeatedly creating and converting between mutable and immutable forms. Since the target is version 3.21.12 (onboarded from upstream after 3.21.7), it...", "justification": "code_not_present" } }, { "id": "CVE-2022-3509", "affects": [ { "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bb66833a-c844-59f3-982c-5a2e7beb1aa1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-3509 does not affect version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-java. CVE-2022-3509 affects protobuf-java versions prior to 3.21.7. The target repository is version 3.21.12-tuxcare.2, which inherits the upstream fix that was introduced in version 3.21.7. The fix (commit a3888f53 by Mike Kruskal) was already present when version 3.21.12 was onboarded by TuxCare. The vulnerable code pattern (direct calls to builder.getFieldBuilder() without null checking in mergeGroup/mergeMessage methods) is absent from the codebase. The fix prevents denial of service by avoiding repeated conversions between mutable and immutable message forms during TextFormat parsing of non-repeated embedded messages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (< 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7).", "justification": "code_not_present" } }, { "id": "CVE-2022-3510", "affects": [ { "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12-tuxcare.2" } ], "bom-ref": "urn:uuid:c31f62c0-b6e6-5732-a98d-1b56a776f205", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-3510 does not affect version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-java. The target repository (protobuf version 3.21.12) is NOT affected by CVE-2022-3510. The vulnerability was fixed in upstream version 3.21.7 (released 2022-09-29) and the fix was already present when TuxCare onboarded version 3.21.12. The vulnerable pattern of repeatedly converting message-type extensions between mutable and immutable forms during parsing is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), NVD (>= 3.16.0, < 3.16.3; >= 3.19.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.16.0, < 3.16.3; >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7), Snyk (>= 3.16.0, < 3.16.3; >= 3.19.0-rc-1, < 3.19.6; >= 3.20.0-rc-1, < 3.20.3; >= 3.21.0-rc-1, < 3.21.7).", "justification": "code_not_present" } }, { "id": "CVE-2024-7254", "affects": [ { "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12-tuxcare.2" } ], "bom-ref": "urn:uuid:4a9d190f-90fe-5e14-aaef-87582c25bedf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-7254 is fixed in version 3.21.12-tuxcare.2 of com.google.protobuf:protobuf-java." } } ], "dependencies": [ { "ref": "pkg:maven/com.google.protobuf/protobuf-java@3.21.12-tuxcare.2" } ] }