CVE-2019-11939 Golang Facebook Thrift servers vulnerable to denial of service
Malicious clients can cause excessive memory allocation and denial of service in Golang Facebook Thrift servers by sending crafted messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11939?
CVE-2019-11939 is a high-severity denial of service vulnerability in Facebook Thrift, published on 18 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.
Weakness: CWE-770
Which versions are affected by CVE-2019-11939?
3 open source packages ship an affected version, including github.com/facebook/fbthrift. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/facebook/fbthrift Go | All versions | 0.31.1-0.20200311080807-483ed864d69f |
github.com/facebook/fbthrift Go | All versions | 0.31.1-0.20200311080807-483ed864d69f |
github.com/facebook/fbthrift Go | All versions | 0.31.1-0.20200311080807-483ed864d69f |
Products include Facebook Thrift.
How do I fix CVE-2019-11939?
Upgrade github.com/facebook/fbthrift to 0.31.1-0.20200311080807-483ed864d69f or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-11939 being exploited?
There is no known exploitation of CVE-2019-11939 in the wild and no public exploit code.
Other vulnerabilities in Facebook Thrift
Sources
Also known as GHSA-w3r9-r9w7-8h48, GO-2021-0082, UBUNTU-CVE-2019-11939.