CVE-2020-1898
CVE-2020-1898
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
CVSS 7.5 · High · EPSS 1.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
hhvm
- Versions
- ≥ 4.62.1, < unspecified: Not affected (custom)
- 4.62.0: Affected
- ≥ 4.61.1, < unspecified: Not affected (custom)
- 4.61.0: Affected
- ≥ 4.60.1, < unspecified: Not affected (custom)
- 4.60.0: Affected
- ≥ 4.59.1, < unspecified: Not affected (custom)
- 4.59.0: Affected
- ≥ 4.58.2, < unspecified: Not affected (custom)
- ≥ 4.58.0, < unspecified: Affected (custom)
- ≥ 4.57.1, < unspecified: Not affected (custom)
- 4.57.0: Affected
- ≥ 4.56.1, < unspecified: Not affected (custom)
- ≥ 4.33.0, < unspecified: Affected (custom)
- ≥ 4.32.3, < unspecified: Not affected (custom)
- ≥ unspecified, < 4.32.3: Affected (custom)
Update to 4.32.3
hhvm Ubuntu:16.04:LTS
- Versions
- 3.11.0+dfsg-1
- 3.11.1+dfsg-1
- 3.11.1+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
hhvm Ubuntu:18.04:LTS
- Versions
- 3.21.0+dfsg-2
- 3.21.0+dfsg-2build1
- 3.21.0+dfsg-2build2
- 3.21.0+dfsg-2build3
- 3.21.0+dfsg-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published