CVE-2019-3552
published 2019-05-06CVE-2019-3552: C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.98%
78.4th percentile
C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| facebook_thrift | — | — | |
| facebook_thrift | >= unspecified < v2019.02.18.00 | v2019.02.18.00 | |
| thrift | < 2019.02.18.00 | 2019.02.18.00 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h27g-g76x-xqpw: C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type
ghsa_unreviewed·2022-05-24
CVE-2019-3552 [HIGH] CWE-20 GHSA-h27g-g76x-xqpw: C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type
C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
OSV
CVE-2019-3552: C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type
osv·2019-05-06·CVSS 7.5
CVE-2019-3552 [HIGH] CVE-2019-3552: C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type
C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/108279https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62bhttps://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Ehttp://www.securityfocus.com/bid/108279https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62bhttps://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
2019-05-06
Published