CVE-2023-23759

2023-05-1821:21:02

facebook

www.cve.org

vulnerability

fizz library

denial of service

remote

check failure

process crash

0.001 Low

EPSS

Percentile

38.1%

JSON

There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process (impact is limited to denial of service).

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "fizz",
    "vendor": "Facebook",
    "versions": [
      {
        "lessThan": "v2023.01.30.00",
        "status": "affected",
        "version": "v0.0.0.0",
        "versionType": "semver"
      }
    ]
  }
]