SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2019-11936

Various APC functions accept keys containing null bytes as input, leading to premature truncation of input.

CRITICAL 9.8EPSS 1.48%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.48% probability · 72th percentile
CISA KEV
Not listed
Weakness
CWE-626
Affected
facebook/hhvm
Source
cve-assign@fb.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.