CVE-2019-3564: Input Validation
First published: Mon May 06 2019(Updated: )
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
Credit: cve-assign@fb.com cve-assign@fb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Facebook Thrift | <2019.03.04.00 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-3564
- https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
- https://www.facebook.com/security/advisories/cve-2019-3564
- https://pkg.go.dev/vuln/GO-2021-0088
- https://github.com/advisories/GHSA-x4rg-4545-4w7w (Advisory)
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
Frequently Asked Questions
What is CVE-2019-3564?
CVE-2019-3564 is a vulnerability that affects Go Facebook Thrift servers and could potentially lead to denial of service.
How does CVE-2019-3564 affect Facebook Thrift?
CVE-2019-3564 affects Facebook Thrift servers by allowing malicious clients to send short messages that could take a long time for the server to parse, potentially leading to denial of service.
What is the severity of CVE-2019-3564?
The severity of CVE-2019-3564 is high with a CVSS score of 7.5.
How do I fix CVE-2019-3564?
To fix CVE-2019-3564, update Facebook Thrift to version 0.31.1-0.20190225164308-c461c1bd1a3e or later.
Where can I find more information about CVE-2019-3564?
You can find more information about CVE-2019-3564 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-3564), [GitHub](https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156), [Apache Mailing List](https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E).
- collector/github-advisory-latest
- alias/GHSA-x4rg-4545-4w7w
- alias/CVE-2019-3564
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- agent/trending
- package-manager/go
- vendor/facebook
- canonical/facebook thrift