CVE:CVE-2022-3171
CNNVD:CNNVD-202210-769
Google protobuf是美国谷歌（Google）公司的一种数据交换格式。
Google protobuf 3.21.7、3.20.3、3.19.6 和 3.16.3之前版本存在安全漏洞，该漏洞源于在解析二进制和文本格式数据的过程中发现了 core 和 lite 中潜在的拒绝服务问题，包含多个具有重复或未知字段的非重复嵌入消息实例的输入流会导致对象在可变和不可变形式之间来回转换，从而导致潜在的长时间垃圾收集暂停。
solution:Upgrade google google-protobuf to a higher version than 3.16.3,3.19.6,3.20.3,3.21.7,and avoid the version (,3.16.3),[3.17.0,3.19.6),[3.20.0,3.20.3),[3.21.0,3.21.7); Upgrade google protobuf-java to a higher version than 3.16.3,3.19.6,3.20.3,3.21.7,and avoid the version (,3.16.3),[3.17.0,3.19.6),[3.20.0,3.20.3),[3.21.0,3.21.7); Upgrade google protobuf-javalite to a higher version than 3.16.3,3.19.6,3.20.3,3.21.7,and avoid the version (,3.16.3),[3.17.0,3.19.6),[3.20.0,3.20.3),[3.21.0,3.21.7); Upgrade google protobuf-kotlin to a higher version than 3.16.3,3.19.6,3.20.3,3.21.7,and avoid the version (,3.16.3),[3.17.0,3.19.6),[3.20.0,3.20.3),[3.21.0,3.21.7); Upgrade google protobuf-kotlin-lite to a higher version than 3.16.3,3.19.6,3.20.3,3.21.7,and avoid the version (,3.16.3),[3.17.0,3.19.6),[3.20.0,3.20.3),[3.21.0,3.21.7); Upgrade fedoraproject fedora to a higher version than 37,and avoid the version 37