VulnerabilityModified
CVE-2020-1898
The fb_unserialize function did not impose a depth limit for nested deserialization.
HIGH 7.5EPSS 1.21%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.21% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-674
- Affected
- facebook/hhvm
- Source
- cve-assign@fb.com
References
- https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684cPatch, Third Party Advisory
- https://hhvm.com/blog/2020/06/30/security-update.htmlVendor Advisory
- https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684cPatch, Third Party Advisory
- https://hhvm.com/blog/2020/06/30/security-update.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.