PT-2019-16605 · Facebook · Wangle

Published 2019-01-15 · Updated 2019-10-09 · CVE-2019-3554

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wangle versions prior to v2019.01.14.00

Description The issue arises from Wangle's AcceptRoutingHandler incorrectly casting a socket when accepting a TLS 1.3 connection. This can lead to a potential denial of service attack against systems that accept such connections.

Recommendations For versions prior to v2019.01.14.00, update to version v2019.01.14.00 or later to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-19

Related Identifiers

CVE-2019-3554

Affected Products

Wangle

References · 3

• https://github.com/facebook/wangle/commit/3b17ba10a82c71e7808760e027ac6af687e06074 · Patch
• https://osv.dev/vulnerability/CVE-2019-3554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3554 · Security Note