PT-2019-12560 · Fizz · Fizz

Published 2019-08-20 · Updated 2020-08-24 · CVE-2019-11924

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions fizz versions v2019.01.28.00 through v2019.08.04.00

Description A peer could send empty handshake fragments containing only padding, which would be kept in memory until a full handshake was received, resulting in memory exhaustion.

Recommendations For versions v2019.01.28.00 through v2019.08.04.00, update to version v2019.08.05.00 or later to resolve the issue.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2019-11924

Affected Products

Fizz

References · 5

• https://github.com/facebookincubator/fizz/commit/3eaddb33619eaaf74a760872850c550ad8f5c52f · Patch
• https://github.com/facebookincubator/fizz/commit/6bf67137ef1ee5cd70c842b014c322b7deaf994b · Patch
• https://osv.dev/vulnerability/CVE-2019-11924 · Vendor Advisory
• https://facebook.com/security/advisories/cve-2019-11924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11924 · Security Note