CVE-2018-6343

Published: Dec 31, 2018Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.

Affected (1)

Products: Facebook: Proxygen

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Facebook Proxygen	From 2018.10.29.00 to 2018.11.19.00

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (2)

https://github.com/facebook/proxygen/commit/0600ebe59c3e82cd012def77ca9ca1918da74a71

Source: cve-assign@fb.com

PatchThird Party Advisory

https://github.com/facebook/proxygen/commit/0600ebe59c3e82cd012def77ca9ca1918da74a71

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.