GHSA-w3r9-r9w7-8h48

Suggest an improvement
Source
https://github.com/advisories/GHSA-w3r9-r9w7-8h48
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w3r9-r9w7-8h48/GHSA-w3r9-r9w7-8h48.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-w3r9-r9w7-8h48
Aliases
Related
Published
2022-05-24T17:11:45Z
Modified
2024-09-11T06:12:37.728644Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Golang Facebook Thrift servers vulnerable to denial of service
Details

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.

Specific Go Packages Affected

github.com/facebook/fbthrift/thrift/lib/go/thrift

Database specific
{
    "nvd_published_at": "2020-03-18T01:15:00Z",
    "cwe_ids": [
        "CWE-770"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T00:26:28Z"
}
References

Affected packages

Go / github.com/facebook/fbthrift

Package

Name
github.com/facebook/fbthrift
View open source insights on deps.dev
Purl
pkg:golang/github.com/facebook/fbthrift

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.31.1-0.20200311080807-483ed864d69f