CVE-2019-3564: Denial of Service in github.com/facebook/fbthrift
Summary
CVE-2019-3564: Improper Input Validation and Excessive Iteration in Go Facebook Thrift. Affects github.com/facebook/fbthrift versions < 0.31.1-0.20190225164308-c461c1bd1a3e. Fixed in 0.31.1-0.20190225164308-c461c1bd1a3e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/facebook/fbthrift, which is written in Go. fbthrift is a framework for building scalable and efficient RPC services in various languages. It provides a set of code generation tools and libraries for implementing Thrift services. The vulnerability affects versions 0.0.0 to 0.31.1-0.20190225164308-c461c1bd1a3e of the package.
Vulnerability Detail
The vulnerability, identified as CVE-2019-3564, is a denial of service vulnerability in fbthrift. The issue arises from the fact that the Skip function in the package's protocols ignores unknown fields instead of failing. This allows a malicious user to craft small messages with unknown fields, which can consume significant resources during parsing. If a server accepts messages from an untrusted user, it can be exploited as a vector for denial of service attacks.
How To Fix
Minimum fixed version
0.31.1-0.20190225164308-c461c1bd1a3e
This is the first release that contains the fix.
go get github.com/facebook/fbthrift@v0.31.1-0.20190225164308-c461c1bd1a3eTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is advised to implement input validation and filtering mechanisms in the server application to mitigate the impact of potential denial of service attacks. This can involve validating and sanitizing incoming messages, as well as setting limits on the size and complexity of the messages accepted by the server.
Conclusion
In conclusion, the CVE-2019-3564 vulnerability in github.com/facebook/fbthrift allows for denial of service attacks through the exploitation of unknown fields in small messages. It is crucial to update the fbthrift package to the recommended version and implement input validation mechanisms to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/facebook/fbthrift →
FAQ
fbthrift is a framework for building scalable and efficient RPC services in various languages. It provides code generation tools and libraries for implementing Thrift services.
The vulnerability allows a malicious user to craft small messages with unknown fields, leading to resource-intensive parsing and potential denial of service attacks on servers that accept messages from untrusted users.
To fix the vulnerability, update the fbthrift package to version 0.31.1-0.20190225164308-c461c1bd1a3e or later.
Implement input validation and filtering mechanisms in the server application to mitigate the impact of potential denial of service attacks.
For more information, you can refer to the vulnerability details on the Vulert website: Vulert Scanner
Related vulnerabilities
Recent vulnerabilities recorded for github.com/facebook/fbthrift.
