CVE-2019-11940: Use After Free
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11940?
CVE-2019-11940 is considered a high severity vulnerability due to its potential to cause use-after-free conditions and undefined behavior.
How do I fix CVE-2019-11940?
To fix CVE-2019-11940, upgrade Proxygen to a version later than 2017.04.03.00.
What versions of Proxygen are affected by CVE-2019-11940?
CVE-2019-11940 affects Proxygen versions between 0.29.0 and 2017.04.03.00.
What vulnerability does CVE-2019-11940 exploit during the HTTP2 protocol?
CVE-2019-11940 exploits vulnerabilities in the HPACK header compression process, leading to potential header table corruption.
Is CVE-2019-11940 related to memory safety issues?
Yes, CVE-2019-11940 involves a use-after-free condition, indicating potential memory safety issues in the affected software.