Critical severity · published Dec 4, 2019
CVE-2019-11934
Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Folly · Facebook
before 2019.11.04.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11934
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11934
Patch
https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee
Third Party Advisory
https://www.facebook.com/security/advisories/cve-2019-11934
More from Folly
9.8
CVE-2021-24036
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code…
7.5
CVE-2018-6337
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called