CVE-2018-6343: Input Validation
Published Dec 31, 2018
·Updated
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
Affected Software
1 affected component
Facebook Proxygen>=2018.10.29.00<2018.11.19.00
Remediation
Event History
Dec 31, 2018
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionWeakness
Data Sourced
via NVD·10:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-6343?
CVE-2018-6343 is classified as a denial of service vulnerability.
2
How do I fix CVE-2018-6343?
To fix CVE-2018-6343, update Proxygen to a version later than 2018.11.19.00.
3
What versions of Proxygen are affected by CVE-2018-6343?
CVE-2018-6343 affects Proxygen releases from version 2018.10.29.00 up to 2018.11.19.00.
4
What kind of issue does CVE-2018-6343 cause?
CVE-2018-6343 causes a denial of service issue when parsing Certificate/CertificateRequest frames.
5
Is CVE-2018-6343 specific to any transport protocols?
Yes, CVE-2018-6343 specifically affects HTTP2 frames over a fizz (TLS 1.3) transport.