← Volver a CVEs
CVE-2020-1898
HIGH7.5
Descripcion
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
Detalles CVE
Puntuacion CVSS v3.17.5
SeveridadHIGH
Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vector de ataqueNETWORK
ComplejidadLOW
Privilegios requeridosNONE
Interaccion usuarioNONE
Publicado3/11/2021
Ultima modificacion11/21/2024
Fuentenvd
Avistamientos honeypot0
Productos afectados
facebook:hhvm
Debilidades (CWE)
CWE-674CWE-674
Referencias
https://hhvm.com/blog/2020/06/30/security-update.html(cve-assign@fb.com)
https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c(af854a3a-2127-422b-91ae-364da2661108)
https://hhvm.com/blog/2020/06/30/security-update.html(af854a3a-2127-422b-91ae-364da2661108)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.