CVE-2024-2410

A flaw was found in protobuf, the protocol buffer C++ implementation. A use-after-free can be triggered when reading a crafted JSON input split into separate chunks with the JsonToBinaryStream function. A successful attack may result in data leak or corruption or cause the application to crash.

The protobuf package, as shipped in Red Hat Enterprise Linux 7, 8 and 9, is not affected by this vulnerability because the vulnerable code was introduced in a newer version of protobuf.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not parse a JSON input split into separated chunks using the JsonToBinaryStream function.