PT-2019-16617 · Facebook · Hhvm

Published 2019-06-26 · Updated 2021-09-14 · CVE-2019-3569

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HHVM versions 3.30.5 and below HHVM versions 4.0 through 4.8.0

Description The issue allows a malicious individual unintended direct access to the application, which could result in information disclosure. This is due to HHVM binding by default to all available interfaces when used with FastCGI.

Recommendations For HHVM versions 3.30.5 and below, update to a version above 3.30.5 to resolve the issue. For HHVM versions 4.0 through 4.8.0, update to a version above 4.8.0 to resolve the issue.

Fix

Files Accessible to External Parties

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-552

CWE-668

Related Identifiers

CVE-2019-3569

Affected Products

Hhvm

References · 7

• https://github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed · Patch
• https://osv.dev/vulnerability/CVE-2019-3569 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3569 · Vendor Advisory
• https://hhvm.com/blog/2019/06/10/hhvm-4.9.0.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3569 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-3569 · Security Note