CVE-2020-1899

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-1899
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-1899.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-1899
Downstream
Published
2021-03-11T01:15:14.333Z
Modified
2026-02-24T11:34:35.402544Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

References

Affected packages

Git / github.com/facebook/hhvm

Affected ranges

Type
GIT
Repo
https://github.com/facebook/hhvm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1107228a5128d3ca1c4add8ac1635d933cbbe2e9
Introduced
8df1dd7ead93f50388145dd8d7734a69204b50a7
Fixed
55dc2e1650c1e79e67b7f0ef20e51cd2d504a4bb

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2020-1899-381b6cb0",
        "target": {
            "function": "VariableUnserializer::matchString",
            "file": "hphp/runtime/base/variable-unserializer.cpp"
        },
        "signature_version": "v1",
        "digest": {
            "function_hash": "296497231455137404359568022051131713760",
            "length": 1174.0
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9"
    },
    {
        "id": "CVE-2020-1899-b7606651",
        "target": {
            "file": "hphp/runtime/version.h"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "331473762518125757472384839031571060902",
                "4158620335537989919269120992316136210",
                "37536044244405383633242229082848527784",
                "140335216194151808759673220052749435881"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://github.com/facebook/hhvm/commit/55dc2e1650c1e79e67b7f0ef20e51cd2d504a4bb"
    },
    {
        "id": "CVE-2020-1899-e2430ba7",
        "target": {
            "file": "hphp/runtime/base/variable-unserializer.cpp"
        },
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "305469386172568607995090889127400499800",
                "164748909009527016058299342589249192028",
                "74505882255080775097042379243447366500",
                "321822967609217144650500439140456360480"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9"
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-1899.json"