CVE-2019-11938 - Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload

Back Back to CVE browser

HIGH

Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload

Published Mar 10, 2020

7.5

HIGH

CVSS 3.1

EPSS 2.25%

Description

Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.

Affected products

Vendor Facebook Product Facebook Thrift Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <v2019.12.09.00
- Version
  v2019.12.09.00
  Status
  unaffected
  Constraints
  <unspecified

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Facebook

Facebook Thrift

n/a

Version	Status	Constraints
unspecified	affected	<v2019.12.09.00
v2019.12.09.00	unaffected	<unspecified

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3595
Advisory
https://github.com/facebook/fbthrift/commit/08c2d412adb214c40bb03be7587057b25d053030
x_refsource_MISCPatchThird Party Advisory
https://github.com/facebook/fbthrift/commit/71c97ffdcb61cccf1f8267774e873e21ebd3ebd3
x_refsource_MISCPatchThird Party Advisory
https://www.facebook.com/security/advisories/cve-2019-11938
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3595		Advisory
https://github.com/facebook/fbthrift/commit/08c2d412adb214c40bb03be7587057b25d053030		x_refsource_MISCPatchThird Party Advisory
https://github.com/facebook/fbthrift/commit/71c97ffdcb61cccf1f8267774e873e21ebd3ebd3		x_refsource_MISCPatchThird Party Advisory
https://www.facebook.com/security/advisories/cve-2019-11938		x_refsource_CONFIRMVendor Advisory