PT-2020-9227 · Facebook · Facebook Thrift

Published 2020-03-18 · Updated 2022-05-24 · CVE-2019-11939

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Facebook Thrift versions prior to 2020.03.16.00

Description The issue arises when Golang Facebook Thrift servers fail to error upon receiving messages declaring containers of sizes larger than the payload. This allows malicious clients to send short messages, resulting in large memory allocations and potentially leading to denial of service.

Recommendations For versions prior to 2020.03.16.00, update to version 2020.03.16.00 or later to resolve the issue. As a temporary workaround, consider implementing checks on the declared size of messages to prevent large memory allocations. Restrict access to the Thrift server to minimize the risk of exploitation. Avoid processing messages with declared sizes larger than the actual payload size until the issue is resolved.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2019-11939

GHSA-W3R9-R9W7-8H48

GO-2021-0082

Affected Products

Facebook Thrift

References · 13

• https://github.com/facebook/fbthrift/commit/483ed864d69f307e9e3b9dadec048216100c0757 · Patch
• https://cve.org/CVERecord?id=CVE-2019-11939 · Security Note
• https://osv.dev/vulnerability/GHSA-w3r9-r9w7-8h48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11939 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11939 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11939 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11939 · Vendor Advisory
• https://facebook.com/security/advisories/cve-2019-11939 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0082 · Vendor Advisory
• https://github.com/facebook/fbthrift · Note
• https://pkg.go.dev/vuln/GO-2021-0082 · Note
• https://t.me/cibsecurity/10559 · Telegram Post
• https://t.me/cvenotify/1833 · Telegram Post