CVE-2023-23759

Published May 18, 2023

Last updated a month ago

Overview

Description: There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process (impact is limited to denial of service).
Source: cve-assign@fb.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-617
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-617

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:facebook:fizz:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A867776B-F2FD-4862-9D5F-DFEC19C29DB5",
            "versionEndExcluding": "2023.01.30.00"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References