CVE-2019-3564
Vulnerability from cvelistv5
Published
2019-05-06 15:15
Modified
2024-08-04 19:12
Severity ?
EPSS score ?
Summary
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Facebook Thrift |
Version: v2019.03.04.00 Version: unspecified < v2019.03.04.00 |
|
|
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T19:12:09.508Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.facebook.com/security/advisories/cve-2019-3564", }, { name: "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Facebook Thrift", vendor: "Facebook", versions: [ { status: "affected", version: "v2019.03.04.00", }, { lessThan: "v2019.03.04.00", status: "affected", version: "unspecified", versionType: "custom", }, ], }, ], dateAssigned: "2019-02-25T00:00:00", descriptions: [ { lang: "en", value: "Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-834", description: "Excessive Iteration (CWE-834)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2020-12-16T05:06:24", orgId: "4fc57720-52fe-4431-a0fb-3d2c8747b827", shortName: "facebook", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156", }, { tags: [ "x_refsource_MISC", ], url: "https://www.facebook.com/security/advisories/cve-2019-3564", }, { name: "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve-assign@fb.com", DATE_ASSIGNED: "2019-02-25", ID: "CVE-2019-3564", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Facebook Thrift", version: { version_data: [ { version_affected: "!=>", version_value: "v2019.03.04.00", }, { version_affected: "<", version_value: "v2019.03.04.00", }, ], }, }, ], }, vendor_name: "Facebook", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Excessive Iteration (CWE-834)", }, ], }, ], }, references: { reference_data: [ { name: "https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156", refsource: "MISC", url: "https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156", }, { name: "https://www.facebook.com/security/advisories/cve-2019-3564", refsource: "MISC", url: "https://www.facebook.com/security/advisories/cve-2019-3564", }, { name: "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "4fc57720-52fe-4431-a0fb-3d2c8747b827", assignerShortName: "facebook", cveId: "CVE-2019-3564", datePublished: "2019-05-06T15:15:02", dateReserved: "2019-01-02T00:00:00", dateUpdated: "2024-08-04T19:12:09.508Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2019-3564\",\"sourceIdentifier\":\"cve-assign@fb.com\",\"published\":\"2019-05-06T16:29:01.210\",\"lastModified\":\"2024-11-21T04:42:10.483\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.\"},{\"lang\":\"es\",\"value\":\"Los servidores Thrift de Go Facebook no emitirían errores al recibir mensajes con contenedores de campos de tipo desconocido. En consecuencia, los clientes maliciosos podrían enviar mensajes cortos, lo que llevaría mucho tiempo para que el servidor los analice, esto conllevaría a una Denegación de Servicio. Este problema afecta a Facebook Thrift antes de versión 2019.03.04.00.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cve-assign@fb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-834\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:facebook:thrift:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2019.03.04.00\",\"matchCriteriaId\":\"AB2CB7BA-9067-42CC-883E-533547C95A12\"}]}]}],\"references\":[{\"url\":\"https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156\",\"source\":\"cve-assign@fb.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E\",\"source\":\"cve-assign@fb.com\"},{\"url\":\"https://www.facebook.com/security/advisories/cve-2019-3564\",\"source\":\"cve-assign@fb.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.facebook.com/security/advisories/cve-2019-3564\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}", }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.