CVE-2019-3558
published 2019-05-06CVE-2019-3558: Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.02%
78.8th percentile
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| facebook_thrift | — | — | |
| facebook_thrift | >= unspecified < v2019.02.18.00 | v2019.02.18.00 | |
| thrift | < 2019.02.18.00 | 2019.02.18.00 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7vv7-v9gp-whmr: Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
ghsa_unreviewed·2022-05-24
CVE-2019-3558 [HIGH] CWE-20 GHSA-7vv7-v9gp-whmr: Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
OSV
CVE-2019-3558: Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
osv·2019-05-06·CVSS 7.5
CVE-2019-3558 [HIGH] CVE-2019-3558: Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/108274https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62bhttps://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Ehttps://www.facebook.com/security/advisories/cve-2019-3558http://www.securityfocus.com/bid/108274https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62bhttps://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Ehttps://www.facebook.com/security/advisories/cve-2019-3558
2019-05-06
Published