Denial of Service Vulnerability in Proxygen by Facebook

CVE-2018-6343

What is CVE-2018-6343?

Proxygen, a library developed by Facebook, has a vulnerability that arises from its failure to validate the existence of a secondary authentication manager before attempting to reference it. This oversight can lead to a denial of service during the parsing of Certificate and CertificateRequest HTTP2 Frames over TLS 1.3 transport. The issue has affected Proxygen releases from version v2018.10.29.00 up until the resolution provided in version v2018.11.19.00. Users should ensure they are running the patched version to avoid potential service disruptions.

References