GHSA-x4rg-4545-4w7w

Improper Input Validation and Excessive Iteration in Go Facebook Thrift

Source: GitHub Advisory Database (reviewed) High CVE-2019-3564

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/facebook/fbthrift	< 0.31.1-0.20190225164308-c461c1bd1a3e	0.31.1-0.20190225164308-c461c1bd1a3e

Details

As written in the advisory (Markdown source, shown as plain text).

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-3564 advisory
https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156 web
https://github.com/facebook/fbthrift package
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E web
https://pkg.go.dev/vuln/GO-2021-0088 web
https://www.facebook.com/security/advisories/cve-2019-3564 web