PT-2019-12574 · Facebook · Proxygen

Published 2019-12-04 · Updated 2019-12-17 · CVE-2019-11940

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Proxygen versions 0.29.0 through 2017.04.03.00

Description The issue arises during the decompression of HPACK within the HTTP2 protocol. An unexpected sequence of header table resize operations can corrupt the header table state, resulting in a use-after-free condition and undefined behavior.

Recommendations For Proxygen versions 0.29.0 through 2017.04.03.00, update to a version later than 2017.04.03.00 to resolve the issue.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2019-11940

Affected Products

Proxygen

References · 4

• https://github.com/facebook/proxygen/commit/f43b134cc5c19d8532e7fb670a1c02e85f7a8d4f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-11940 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11940 · Vendor Advisory
• https://facebook.com/security/advisories/cve-2019-11940 · Note