CVE-2019-3558: High severity thrift vulnerability
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-3558.
What is the severity of CVE-2019-3558?
The severity of CVE-2019-3558 is high, with a severity value of 7.5.
Which software is affected by this vulnerability?
Facebook Thrift with versions up to and excluding 2019.02.18.00 is affected by this vulnerability.
How can this vulnerability be exploited?
Malicious clients can exploit this vulnerability by sending short messages with containers of fields of unknown type, causing the server to take a long time to parse and potentially leading to denial of service.
Are there any references for more information on this vulnerability?
Yes, you can find more information on this vulnerability at the following links: [1] http://www.securityfocus.com/bid/108274, [2] https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62b, [3] https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E