CVE-2018-6343
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
Proxygen no logra validar que un gestor de autenticación secundario sea fijado antes de desreferenciarse. Esto podría provocar una denegación de servicio (DoS) cuando se analiza un frame HTTP2 "Certificate/CertificateRequest" sobre un transporte del tipo fizz (TLS 1.3). Este problema afecta a las distribuciones de Proxygen desde la versión v2018.10.29.00 hasta que se arregla en la v2018.10.29.00.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2018-01-26 CVE Reserved
- 2018-12-31 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-476: NULL Pointer Dereference
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/facebook/proxygen/commit/0600ebe59c3e82cd012def77ca9ca1918da74a71 | 2019-10-09 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Facebook Search vendor "Facebook" | Proxygen Search vendor "Facebook" for product "Proxygen" | >= 2018.10.29.00 < 2018.11.19.00 Search vendor "Facebook" for product "Proxygen" and version " >= 2018.10.29.00 < 2018.11.19.00" | - |
Affected
| ||||||