CVE catalog
CVE-2024-24786
Google Guest Agent and Google OS Config Agent vulnerability
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.26% · Oct 25, 2026
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-google-protobuf | sid | 1.36.10-2 | fixed |
| Debian | golang-google-protobuf | forky | 1.36.10-2 | fixed |
| Debian | golang-google-protobuf | trixie | 1.36.5-1 | fixed |
| Debian | golang-google-protobuf | bookworm | 1.28.1-3 | vulnerable |
| Ubuntu | golang-google-protobuf | noble | Not reported | vulnerable |
| Ubuntu | google-guest-agent | noble | 20240213.00-0ubuntu3.1 | fixed |
| Ubuntu | google-osconfig-agent | noble | 20240320.00-0ubuntu1~24.04.1 | fixed |
| Go | google.golang.org/protobuf | Not reported | 1.33.0 | fixed |
| Go | google.golang.org/protobuf/encoding/protojson | Not reported | 1.33.0 | fixed |
| Go | google.golang.org/protobuf/internal/encoding/json | Not reported | 1.33.0 | fixed |
| Go | google.golang.org/protobuf | Not reported | 1.33.0 | fixed |
| Ubuntu | google-guest-agent | 24.04 | 20230426.00-0ubuntu3 | vulnerable |
| Ubuntu | google-guest-agent | 24.04 | 20231004.02-0ubuntu1 | vulnerable |
| Ubuntu | google-guest-agent | 24.04 | 20231004.02-0ubuntu3 | vulnerable |
| Ubuntu | google-guest-agent | 24.04 | 20240213.00-0ubuntu1 | vulnerable |
| Ubuntu | google-guest-agent | 24.04 | 20240213.00-0ubuntu2 | vulnerable |
| Ubuntu | google-guest-agent | 24.04 | 20240213.00-0ubuntu3 | vulnerable |
| Ubuntu | google-guest-agent | 24.04 | 20240213.00-0ubuntu3.1 | fixed |
| Ubuntu | google-osconfig-agent | 24.04 | 20230504.00-0ubuntu2 | vulnerable |
| Ubuntu | google-osconfig-agent | 24.04 | 20230504.00-0ubuntu3 | vulnerable |
| Ubuntu | google-osconfig-agent | 24.04 | 20240320.00-0ubuntu1~24.04.0 | vulnerable |
| Ubuntu | google-osconfig-agent | 24.04 | 20240320.00-0ubuntu1~24.04.1 | fixed |
| Ubuntu | google-guest-agent | 22.04 | 20210629.00-0ubuntu1 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20210629.00-0ubuntu2 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20220104.00-0ubuntu1 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20220104.00-0ubuntu2 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20220622.00-0ubuntu2~22.04.0 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20220622.00-0ubuntu2~22.04.1 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20230426.00-0ubuntu2~22.04.0 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20231004.02-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20231004.02-0ubuntu1~22.04.2 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20231004.02-0ubuntu1~22.04.3 | vulnerable |
| Ubuntu | google-guest-agent | 22.04 | 20231004.02-0ubuntu1~22.04.4 | fixed |
| Ubuntu | google-osconfig-agent | 22.04 | 20210608.1-0ubuntu1 | vulnerable |
| Ubuntu | google-osconfig-agent | 22.04 | 20210608.1-0ubuntu2 | vulnerable |
| Ubuntu | google-osconfig-agent | 22.04 | 20210608.1-0ubuntu3 | vulnerable |
| Ubuntu | google-osconfig-agent | 22.04 | 20220824.00-0ubuntu1~22.04.1 | vulnerable |
| Ubuntu | google-osconfig-agent | 22.04 | 20220824.00-0ubuntu1~22.04.2 | vulnerable |
| Ubuntu | google-osconfig-agent | 22.04 | 20230504.00-0ubuntu1~22.04.0 | vulnerable |
| Ubuntu | google-osconfig-agent | 22.04 | 20230504.00-0ubuntu1~22.04.1 | fixed |
| Opensuse | buildah | tumbleweed | 1.35.3-1.1 | fixed |
| Opensuse | kubernetes1.26 | tumbleweed | 1.26.15-1.1 | fixed |
| Opensuse | kubernetes1.27 | tumbleweed | 1.27.12-1.1 | fixed |
| Opensuse | rclone | tumbleweed | 1.66.0-1.1 | fixed |
| Opensuse | kubernetes1.29 | tumbleweed | 1.29.3-1.1 | fixed |
| Opensuse | kubernetes1.28 | tumbleweed | 1.28.8-1.1 | fixed |
| Suse | podman | linux enterprise micro 5.3 | 4.9.5-150400.4.27.1 | fixed |
| Suse | podman | linux enterprise micro 5.4 | 4.9.5-150400.4.27.1 | fixed |
| Suse | podman | linux enterprise high performance computing 15 sp4-espos | 4.9.5-150400.4.27.1 | fixed |
| Suse | podman | linux enterprise high performance computing 15 sp4-ltss | 4.9.5-150400.4.27.1 | fixed |
| Suse | podman | linux enterprise server 15 sp4-ltss | 4.9.5-150400.4.27.1 | fixed |
| Suse | podman | linux enterprise server for sap applications 15 sp4 | 4.9.5-150400.4.27.1 | fixed |
| Opensuse | podman | leap micro 5.3 | 4.9.5-150400.4.27.1 | fixed |
| Opensuse | podman | leap micro 5.4 | 4.9.5-150400.4.27.1 | fixed |
| Suse | podman | linux enterprise high performance computing 15 sp3-ltss | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise server 15 sp3-ltss | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise server for sap applications 15 sp3 | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise micro 5.1 | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise micro 5.2 | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | enterprise storage 7.1 | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise high performance computing 15 sp3-ltss | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise server 15 sp3-ltss | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise server for sap applications 15 sp3 | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise micro 5.1 | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise micro 5.2 | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | enterprise storage 7.1 | 4.9.5-150300.9.31.1 | fixed |
| Suse | podman | linux enterprise micro 5.5 | 4.9.5-150500.3.12.1 | fixed |
| Suse | podman | linux enterprise module for containers 15 sp5 | 4.9.5-150500.3.12.1 | fixed |
| Suse | podman | linux enterprise module for containers 15 sp6 | 4.9.5-150500.3.12.1 | fixed |
| Opensuse | podman | leap 15.5 | 4.9.5-150500.3.12.1 | fixed |
| Opensuse | podman | leap 15.6 | 4.9.5-150500.3.12.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-google-protobuf | source | sid | 1.33.0-1 | not yet assigned | Not reported | [1065684] |
| Debian | golang-google-protobuf | source | forky | 1.33.0-1 | not yet assigned | Not reported | [1065684] |
| Debian | golang-google-protobuf | source | trixie | 1.33.0-1 | not yet assigned | Not reported | [1065684] |
| Debian | golang-google-protobuf | source | bookworm | (unfixed) | not yet assigned | Not reported | [1065684] |
| Ubuntu | google-guest-agent | deb | noble | 20240213.00-0ubuntu3.1 | Not reported | Not reported | Not reported |
| Ubuntu | google-osconfig-agent | deb | noble | 20240320.00-0ubuntu1~24.04.1 | Not reported | Not reported | Not reported |
| Go | google.golang.org/protobuf | Go | Not reported | 1.33.0 | Not reported | GHSA-8R3F-844C-MC37 | Not reported |
| Go | google.golang.org/protobuf/encoding/protojson | Go | Not reported | 1.33.0 | Not reported | GHSA-8R3F-844C-MC37 | Not reported |
| Go | google.golang.org/protobuf/internal/encoding/json | Go | Not reported | 1.33.0 | Not reported | GHSA-8R3F-844C-MC37 | Not reported |
| Go | google.golang.org/protobuf | Go | Not reported | 1.33.0 | Not reported | GO-2024-2611 | Not reported |
| Ubuntu | google-guest-agent | deb | 24.04 | 20240213.00-0ubuntu3.1 | Not reported | USN-6746-2 | Not reported |
| Ubuntu | google-osconfig-agent | deb | 24.04 | 20240320.00-0ubuntu1~24.04.1 | Not reported | USN-6746-2 | Not reported |
| Ubuntu | google-guest-agent | deb | 22.04 | 20231004.02-0ubuntu1~22.04.4 | Not reported | USN-6746-1 | Not reported |
| Ubuntu | google-osconfig-agent | deb | 22.04 | 20230504.00-0ubuntu1~22.04.1 | Not reported | USN-6746-1 | Not reported |
| Opensuse | buildah | rpm | tumbleweed | 1.35.3-1.1 | Not reported | OPENSUSE-SU-2024:13814-1 | Not reported |
| Opensuse | kubernetes1.26 | rpm | tumbleweed | 1.26.15-1.1 | Not reported | OPENSUSE-SU-2024:13838-1 | Not reported |
| Opensuse | kubernetes1.27 | rpm | tumbleweed | 1.27.12-1.1 | Not reported | OPENSUSE-SU-2024:13839-1 | Not reported |
| Opensuse | rclone | rpm | tumbleweed | 1.66.0-1.1 | Not reported | OPENSUSE-SU-2024:13781-1 | Not reported |
| Opensuse | kubernetes1.29 | rpm | tumbleweed | 1.29.3-1.1 | Not reported | OPENSUSE-SU-2024:13841-1 | Not reported |
| Opensuse | kubernetes1.28 | rpm | tumbleweed | 1.28.8-1.1 | Not reported | OPENSUSE-SU-2024:13840-1 | Not reported |
| Suse | podman | rpm | linux enterprise micro 5.3 | 4.9.5-150400.4.27.1 | Not reported | SUSE-SU-2024:2090-1 | Not reported |
| Suse | podman | rpm | linux enterprise micro 5.4 | 4.9.5-150400.4.27.1 | Not reported | SUSE-SU-2024:2090-1 | Not reported |
| Suse | podman | rpm | linux enterprise high performance computing 15 sp4-espos | 4.9.5-150400.4.27.1 | Not reported | SUSE-SU-2024:2090-1 | Not reported |
| Suse | podman | rpm | linux enterprise high performance computing 15 sp4-ltss | 4.9.5-150400.4.27.1 | Not reported | SUSE-SU-2024:2090-1 | Not reported |
| Suse | podman | rpm | linux enterprise server 15 sp4-ltss | 4.9.5-150400.4.27.1 | Not reported | SUSE-SU-2024:2090-1 | Not reported |
| Suse | podman | rpm | linux enterprise server for sap applications 15 sp4 | 4.9.5-150400.4.27.1 | Not reported | SUSE-SU-2024:2090-1 | Not reported |
| Opensuse | podman | rpm | leap micro 5.3 | 4.9.5-150400.4.27.1 | Not reported | SUSE-SU-2024:2090-1 | Not reported |
| Opensuse | podman | rpm | leap micro 5.4 | 4.9.5-150400.4.27.1 | Not reported | SUSE-SU-2024:2090-1 | Not reported |
| Suse | podman | rpm | linux enterprise high performance computing 15 sp3-ltss | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-2 | Not reported |
| Suse | podman | rpm | linux enterprise server 15 sp3-ltss | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-2 | Not reported |
| Suse | podman | rpm | linux enterprise server for sap applications 15 sp3 | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-2 | Not reported |
| Suse | podman | rpm | linux enterprise micro 5.1 | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-2 | Not reported |
| Suse | podman | rpm | linux enterprise micro 5.2 | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-2 | Not reported |
| Suse | podman | rpm | enterprise storage 7.1 | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-2 | Not reported |
| Suse | podman | rpm | linux enterprise high performance computing 15 sp3-ltss | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-1 | Not reported |
| Suse | podman | rpm | linux enterprise server 15 sp3-ltss | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-1 | Not reported |
| Suse | podman | rpm | linux enterprise server for sap applications 15 sp3 | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-1 | Not reported |
| Suse | podman | rpm | linux enterprise micro 5.1 | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-1 | Not reported |
| Suse | podman | rpm | linux enterprise micro 5.2 | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-1 | Not reported |
| Suse | podman | rpm | enterprise storage 7.1 | 4.9.5-150300.9.31.1 | Not reported | SUSE-SU-2024:2050-1 | Not reported |
| Suse | podman | rpm | linux enterprise micro 5.5 | 4.9.5-150500.3.12.1 | Not reported | SUSE-SU-2024:2031-1 | Not reported |
| Suse | podman | rpm | linux enterprise module for containers 15 sp5 | 4.9.5-150500.3.12.1 | Not reported | SUSE-SU-2024:2031-1 | Not reported |
| Suse | podman | rpm | linux enterprise module for containers 15 sp6 | 4.9.5-150500.3.12.1 | Not reported | SUSE-SU-2024:2031-1 | Not reported |
| Opensuse | podman | rpm | leap 15.5 | 4.9.5-150500.3.12.1 | Not reported | SUSE-SU-2024:2031-1 | Not reported |
| Opensuse | podman | rpm | leap 15.6 | 4.9.5-150500.3.12.1 | Not reported | SUSE-SU-2024:2031-1 | Not reported |
Notes
[bookworm] golang-google-protobuf: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2024_3254.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2024-24786]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-24786]
- [https://osv.dev/vulnerability/GO-2024-2611]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2031-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2050-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2050-2]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2090-1]
- [https://osv.dev/vulnerability/USN-6746-1]
- [https://osv.dev/vulnerability/USN-6746-2]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13781-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13814-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13838-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13839-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13840-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13841-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-24786]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-24786.json]
- [https://ubuntu.com/security/notices/USN-6746-2]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1226.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]