CVE-2018-6343: Input Validation

Q: What is the severity of CVE-2018-6343?

CVE-2018-6343 is classified as a denial of service vulnerability.

Q: How do I fix CVE-2018-6343?

To fix CVE-2018-6343, update Proxygen to a version later than 2018.11.19.00.

Q: What versions of Proxygen are affected by CVE-2018-6343?

CVE-2018-6343 affects Proxygen releases from version 2018.10.29.00 up to 2018.11.19.00.

Q: What kind of issue does CVE-2018-6343 cause?

CVE-2018-6343 causes a denial of service issue when parsing Certificate/CertificateRequest frames.

Q: Is CVE-2018-6343 specific to any transport protocols?

Yes, CVE-2018-6343 specifically affects HTTP2 frames over a fizz (TLS 1.3) transport.

Published Dec 31, 2018

Updated

Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.

Affected Software

1 affected component

Facebook Proxygen>=2018.10.29.00<2018.11.19.00

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Proxygen to a version that resolves this vulnerability.
Fixed in v2018.11.19.00

Event History

Dec 31, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionWeakness

Data Sourced

via OSV·10:29 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2018-6343?

CVE-2018-6343 is classified as a denial of service vulnerability.

How do I fix CVE-2018-6343?