PT-2019-12558 · Facebook · Proxygen

Published 2019-07-25 · Updated 2019-08-02 · CVE-2019-11921

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Proxygen versions prior to v2019.07.22.00

Description The issue is caused by improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers, allowing an out of bounds write via a specially crafted packet in certain configurations.

Recommendations For versions prior to v2019.07.22.00, update to version v2019.07.22.00 or later to resolve the issue. As a temporary workaround, consider restricting access to malformed binary content in Structured HTTP Headers until a patch is applied.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-11921

Affected Products

Proxygen

References · 4

• https://github.com/facebook/proxygen/commit/2f07985bef9fbae124cc63e5c0272e32da4fdaec · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-11921 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11921 · Vendor Advisory
• https://facebook.com/security/advisories/cve-2019-11921 · Note