[GHSA-7gcm-g887-7qv7] protobuf affected by a JSON recursion depth bypass

[lucas42]

Updates

• Affected products

Comments
Patched version has been released – see protocolbuffers/protobuf#25070 (comment)

[lucas42]

According to the thread, the team have plans to backport the patch to 6.29.x. I'm not entirely sure how you encode that in your advisory config.
But for now the only patched version is 6.33.5.

[helixplant]

Hi @lucas42,
We will update the advisory to reflect it as fixed in version 6.33.5. At this time, we cannot include the backported fix version as it does not exist, please feel free to open a PR when it is public and we will update the advisory appropriately.

[advisory-database]

Hi @lucas42! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!