Lucene search

[email protected]CVE-2020-1921

HistoryMar 10, 2021 - 4:15 p.m.

CVE-2020-1921

2021-03-1016:15:14

CWE-121

CWE-787

[email protected]

web.nvd.nist.gov

cve-2020-1921

crypt function

buffer overflow

hhvm

security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

44.4%

JSON

In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

Affected configurations

NVD

Node

facebookhhvmRange<4.56.3

facebookhhvmRange4.57.0–4.80.2

facebookhhvmRange4.81.0–4.93.2

facebookhhvmMatch4.94.0

facebookhhvmMatch4.95.0

facebookhhvmMatch4.96.0

facebookhhvmMatch4.97.0

facebookhhvmMatch4.98.0

CPENameOperatorVersion
facebook:hhvmfacebook hhvmlt4.56.3
facebook:hhvmfacebook hhvmlt4.80.2
facebook:hhvmfacebook hhvmlt4.93.2
facebook:hhvmfacebook hhvmeq4.94.0
facebook:hhvmfacebook hhvmeq4.95.0
facebook:hhvmfacebook hhvmeq4.96.0
facebook:hhvmfacebook hhvmeq4.97.0
facebook:hhvmfacebook hhvmeq4.98.0

CPE	Name	Operator	Version
facebook:hhvm	facebook hhvm	lt	4.56.3
facebook:hhvm	facebook hhvm	lt	4.80.2
facebook:hhvm	facebook hhvm	lt	4.93.2
facebook:hhvm	facebook hhvm	eq	4.94.0
facebook:hhvm	facebook hhvm	eq	4.95.0
facebook:hhvm	facebook hhvm	eq	4.96.0
facebook:hhvm	facebook hhvm	eq	4.97.0
facebook:hhvm	facebook hhvm	eq	4.98.0

CNA Affected

[
  {
    "product": "HHVM",
    "vendor": "Facebook",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.98.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.98.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.97.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.97.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.96.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.96.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.95.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.95.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.94.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.94.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.93.2",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.81.0",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.80.2",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.57.0",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.56.3",
        "versionType": "custom"
      },
      {
        "lessThan": "4.56.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca

hhvm.com/blog/2021/02/25/security-update.html

Social References

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

44.4%

JSON

Related for CVE-2020-1921

cvelist1 prion1 osv1 nvd1 ubuntucve1