PT-2019-12574 · Facebook · Proxygen

Publicado 2019-12-04 · Atualizado 2019-12-17 · CVE-2019-11940

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Proxygen versions 0.29.0 through 2017.04.03.00

Description The issue arises during the decompression of HPACK within the HTTP2 protocol. An unexpected sequence of header table resize operations can corrupt the header table state, resulting in a use-after-free condition and undefined behavior.

Recommendations For Proxygen versions 0.29.0 through 2017.04.03.00, update to a version later than 2017.04.03.00 to resolve the issue.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2019-11940

Produtos afetados

Proxygen

Referências · 4

• https://github.com/facebook/proxygen/commit/f43b134cc5c19d8532e7fb670a1c02e85f7a8d4f · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-11940 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11940 · Aviso do Fabricante
• https://facebook.com/security/advisories/cve-2019-11940 · Nota