CVE-2020-1898
published 2021-03-11CVE-2020-1898: The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.21%
64.6th percentile
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hhvm | < 4.32.3 | 4.32.3 | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | >= 4.33.0 < unspecified | unspecified | |
| hhvm | >= 4.33.0 < 4.56.1 | 4.56.1 | |
| hhvm | >= 4.58.0 < unspecified | unspecified | |
| hhvm | >= unspecified < 4.32.3 | 4.32.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-86q4-p3xc-6m2h: The fb_unserialize function did not impose a depth limit for nested deserialization
ghsa_unreviewed·2022-05-24
CVE-2020-1898 [HIGH] CWE-674 GHSA-86q4-p3xc-6m2h: The fb_unserialize function did not impose a depth limit for nested deserialization
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
OSV
CVE-2020-1898: The fb_unserialize function did not impose a depth limit for nested deserialization
osv·2021-03-11·CVSS 7.5
CVE-2020-1898 [HIGH] CVE-2020-1898: The fb_unserialize function did not impose a depth limit for nested deserialization
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-03-11
Published