CVE-2023-23759: High severity facebook fizz vulnerability
Published May 18, 2023
·Updated
There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process (impact is limited to denial of service).
Affected Software
1 affected component
Facebook Fizz<2023.01.30.00
Remediation
Patch Available
Event History
May 18, 2023
CVE Published
via MITRE·09:21 PM
Data Sourced
via MITRE·09:21 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-23759.
2
What is the severity of CVE-2023-23759?
The severity of CVE-2023-23759 is high with a severity value of 7.5.
3
Which software is affected by CVE-2023-23759?
The Fizz library prior to v2023.01.30.00 is affected by CVE-2023-23759.
4
How can CVE-2023-23759 be exploited?
CVE-2023-23759 can be exploited remotely by triggering a CHECK failure through a change in supported cipher advertisement.
5
Is there a fix available for CVE-2023-23759?
Yes, the fix for CVE-2023-23759 is available with the v2023.01.30.00 release of the Fizz library.