Protobuf DoS

[DarkaMaul]

This (public) advisory follows two emails sent on August 9 and October 3rd.

The crate is affected by the same vulnerability as described in GHSA-735f-pc8j-v9w8

[jayvdb]

ping @stepancheg

[tnull]

The crate is affected by the same vulnerability as described in GHSA-735f-pc8j-v9w8

Given that this affects multiple implementations across different languages, do we know whether other Rust protobuf implementations such as prost might also be affected?

[DarkaMaul]

The crate is affected by the same vulnerability as described in GHSA-735f-pc8j-v9w8

Given that this affects multiple implementations across different languages, do we know whether other Rust protobuf implementations such as prost might also be affected?

From my understanding, prost is not affected by the same issue:

• it does not support unknown fields ( Add support for unknown fields tokio-rs/prost#2 )
• it performs a recursion depth limit check when parsing unknown fields

[tnull]

From my understanding, prost is not affected by the same issue:

• it does not support unknown fields
• it performs a recursion depth limit check when parsing unknown fields

That makes sense. Thank you for clarifying!

[tarcieri]

The crate is affected by the same vulnerability as described in GHSA-735f-pc8j-v9w8

@DarkaMaul sorry for the belated review, can you add an alias for this?

[woodruffw]

The crate is affected by the same vulnerability as described in GHSA-735f-pc8j-v9w8

@DarkaMaul sorry for the belated review, can you add an alias for this?

Just to clarify, you mean an aliases = [] entry, right?

I'll let @DarkaMaul opine as well, but IMO it might not be an appropriate alias in this case -- the GHSA is for the same class of vulnerability, but for a completely different actual vulnerability (that one is Java only).

(OTOH, maybe this makes sense in the related = [] set?)

[tarcieri]

@woodruffw yeah, related sounds good