GitHub Advisoryadvisory · Go

GHSA-x4rg-4545-4w7w Improper Input Validation and Excessive Iteration in Go Facebook Thrift

HIGH Published 2022-02-15 Modified 2021-11-03 Official page ↗
Aliases
CVE-2019-3564
Ecosystem
Go
Packages
github.com/facebook/fbthrift
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-755, CWE-834
Reviewed
2021-05-17

Affected packages

• Go github.com/facebook/fbthrift: < 0.31.1-0.20190225164308-c461c1bd1a3e → fixed in 0.31.1-0.20190225164308-c461c1bd1a3e

Description

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.

Related

Alias · CVE (1)

  • CVE-2019-3564 Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness
  • CWE-834 Excessive Iteration weakness

References