CVE-2019-3559: High severity thrift vulnerability
Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-3559?
CVE-2019-3559 is a vulnerability that affects Java Facebook Thrift servers, allowing malicious clients to send short messages that take a long time to parse and potentially leading to denial of service.
What is the severity of CVE-2019-3559?
The severity of CVE-2019-3559 is high with a severity value of 7.5.
What software is affected by CVE-2019-3559?
CVE-2019-3559 affects Facebook Thrift server versions up to and exclusive of 2019.02.18.00.
How can I fix CVE-2019-3559?
To fix CVE-2019-3559, users should update their Facebook Thrift server to a version that includes the necessary patch.
What are the references for CVE-2019-3559?
References for CVE-2019-3559 include: [1] https://github.com/facebook/fbthrift/commit/a56346ceacad28bf470017a6bda1d5518d0bd943, [2] https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E, [3] https://www.facebook.com/security/advisories/cve-2019-3559