CVE-2018-6343

    Dashboard / Vulnerabilities / CVE-2018-6343

    CVE-2018-6343

    Published: 31 Dec 2018Last Modified: 7 Aug 2026

    Summary:

    Details: Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.

    References: https://github.com/facebook/proxygen/commit/0600ebe59c3e82cd012def77ca9ca1918da74a71

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8d1fbe4c21c29c1b5401f553f2d6f1a9aa2749c7
    Fixed -b87730ff5e019bd1280f91456a60b93dcc64a7c4

    Affected versions

    v2018.11.12.00
    v2018.11.05.00

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High