PT-2019-12560 · Fizz · Fizz

Publicado 2019-08-20 · Atualizado 2020-08-24 · CVE-2019-11924

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions fizz versions v2019.01.28.00 through v2019.08.04.00

Description A peer could send empty handshake fragments containing only padding, which would be kept in memory until a full handshake was received, resulting in memory exhaustion.

Recommendations For versions v2019.01.28.00 through v2019.08.04.00, update to version v2019.08.05.00 or later to resolve the issue.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2019-11924

Produtos afetados

Fizz

Referências · 5

• https://github.com/facebookincubator/fizz/commit/3eaddb33619eaaf74a760872850c550ad8f5c52f · Correção
• https://github.com/facebookincubator/fizz/commit/6bf67137ef1ee5cd70c842b014c322b7deaf994b · Correção
• https://osv.dev/vulnerability/CVE-2019-11924 · Aviso do Fabricante
• https://facebook.com/security/advisories/cve-2019-11924 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11924 · Nota de Segurança