p PatchFirst

CVE-2019-3559

CVE-2019-3559

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.

CVSS 7.5 · High · EPSS 2.0%

Published
Updated

Stack: system

Affected products and versions

  • facebook thrift

    Versions
    • v2019.02.18.00: Affected
    • ≥ unspecified, < v2019.02.18.00: Affected (custom)

    No fix published

  • hhvm Ubuntu:16.04:LTS

    Versions
    • 3.11.0+dfsg-1
    • 3.11.1+dfsg-1
    • 3.11.1+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libthrift-java Ubuntu:16.04:LTS

    Versions
    • 0.9.1-2
    • 0.9.1-2.1~build0.16.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • hhvm Ubuntu:18.04:LTS

    Versions
    • 3.21.0+dfsg-2
    • 3.21.0+dfsg-2build1
    • 3.21.0+dfsg-2build2
    • 3.21.0+dfsg-2build3
    • 3.21.0+dfsg-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libthrift-java Ubuntu:18.04:LTS

    Versions
    • 0.9.1-2
    • 0.9.1-2.1~build0.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →