High severity · published May 18, 2023
CVE-2023-23759
There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process (impact is limited to denial of service).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Fizz · Facebook
before 2023.01.30.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23759
Patch
https://github.com/facebookincubator/fizz/commit/8d3649841597bedfb6986c30431ebad0eb215265
Patch
https://www.facebook.com/security/advisories/cve-2023-23759
More from Fizz
7.5
CVE-2019-11924
A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion
7.5
CVE-2019-3560
An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on user input