CVE-2023-23759

Published: May 18, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process (impact is limited to denial of service).

Affected (1)

Products: Facebook: Fizz

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Facebook Fizz	Before 2023.01.30.00

Related CWEs

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (4)

https://github.com/facebookincubator/fizz/commit/8d3649841597bedfb6986c30431ebad0eb215265

Source: cve-assign@fb.com

Patch

https://www.facebook.com/security/advisories/cve-2023-23759

Source: cve-assign@fb.com

PatchVendor Advisory

https://github.com/facebookincubator/fizz/commit/8d3649841597bedfb6986c30431ebad0eb215265

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://www.facebook.com/security/advisories/cve-2023-23759

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.