CVE-2019-3569

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-3569
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3569.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-3569
Downstream
Published
2019-06-26T15:15:09.887Z
Modified
2026-07-08T16:08:22.172867Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.

References

Affected packages

Git / github.com/facebook/hhvm

Affected ranges

Type
GIT
Repo
https://github.com/facebook/hhvm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c3ef837b239cb6b83b6f18ce7476b9d4858bf5fb
Introduced
7d4f701b9ed004452d695fce4e1ef8f48babbf39
Last affected
8ca4f914698d694c39cbfcd4f607f0e5cd64e705
Fixed
97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.5.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.7.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:facebook:hhvm:4.8.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.30.5"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        },
        {
            "introduced": "4.0.1"
        },
        {
            "last_affected": "4.0.1"
        },
        {
            "introduced": "4.0.2"
        },
        {
            "last_affected": "4.0.2"
        },
        {
            "introduced": "4.0.3"
        },
        {
            "last_affected": "4.0.3"
        },
        {
            "introduced": "4.0.4"
        },
        {
            "last_affected": "4.0.4"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "last_affected": "4.1.0"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "last_affected": "4.2.0"
        },
        {
            "introduced": "4.3.0"
        },
        {
            "last_affected": "4.3.0"
        },
        {
            "introduced": "4.4.0"
        },
        {
            "last_affected": "4.4.0"
        },
        {
            "introduced": "4.5.0"
        },
        {
            "last_affected": "4.5.0"
        },
        {
            "introduced": "4.6.0"
        },
        {
            "last_affected": "4.6.0"
        },
        {
            "introduced": "4.7.0"
        },
        {
            "last_affected": "4.7.0"
        },
        {
            "introduced": "4.8.0"
        },
        {
            "last_affected": "4.8.0"
        }
    ]
}

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.2.0
4.3.0
4.4.0
4.5.0
4.6.0
4.7.0
4.8.0
HHVM-3.*
HHVM-3.30.0
HHVM-3.30.1
HHVM-3.30.2
HHVM-3.30.3
HHVM-3.30.4
HHVM-3.30.5
HHVM-4.*
HHVM-4.8.0
HPHP-2.*
HPHP-2.1.0
gcc-4.*
gcc-4.6
nightly-2019.*
nightly-2019.03.28
nightly-2019.03.29
nightly-2019.03.30
nightly-2019.03.31
nightly-2019.04.01
nightly-2019.04.02
nightly-2019.04.03
nightly-2019.04.04
nightly-2019.04.05
nightly-2019.04.06
nightly-2019.04.07
nightly-2019.04.08
nightly-2019.04.09
nightly-2019.04.10
nightly-2019.04.11
nightly-2019.04.12
nightly-2019.04.13
nightly-2019.04.14
nightly-2019.04.15
nightly-2019.04.16
nightly-2019.04.17
nightly-2019.04.18
nightly-2019.04.19
nightly-2019.04.20
nightly-2019.04.21
nightly-2019.04.22
nightly-2019.04.23
nightly-2019.04.24
nightly-2019.04.25
nightly-2019.04.26
nightly-2019.04.27
nightly-2019.04.28
nightly-2019.04.29
nightly-2019.04.30
nightly-2019.05.01
nightly-2019.05.02
nightly-2019.05.03
nightly-2019.05.04
nightly-2019.05.05
nightly-2019.05.06
nightly-2019.05.07
nightly-2019.05.08
nightly-2019.05.09
nightly-2019.05.10
nightly-2019.05.11
nightly-2019.05.12
nightly-2019.05.13
nightly-2019.05.14
nightly-2019.05.15
nightly-2019.05.16
nightly-2019.05.17
nightly-2019.05.18
nightly-2019.05.19
nightly-2019.05.20
nightly-2019.05.21
nightly-2019.05.22
nightly-2019.05.23
nightly-2019.05.24
nightly-2019.05.25
nightly-2019.05.26
nightly-2019.05.27
nightly-2019.05.28
nightly-2019.05.29
nightly-2019.05.30
nightly-2019.05.31
nightly-2019.06.01
nightly-2019.06.02
nightly-2019.06.03
nightly-2019.06.04
nightly-2019.06.05
nightly-2019.06.06
nightly-2019.06.07
nightly-2019.06.08
nightly-2019.06.09
nightly-2019.06.10
nightly-2019.06.11
Other
pre-hhvm
src-hphp

Database specific

vanir_signatures_modified 
"2026-07-08T16:08:22Z"
vanir_signatures 
[
    {
        "target": {
            "file": "hphp/runtime/server/fastcgi/fastcgi-server.cpp"
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2019-3569-0e80101c",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "137514824064723355843894764939851756089",
                "274485221879760134909049791648411818110",
                "142983643094198605564629967646232518446",
                "6111575993008610184694406316844627987"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed"
    },
    {
        "target": {
            "file": "hphp/runtime/server/fastcgi/fastcgi-server.cpp",
            "function": "FastCGIServer::FastCGIServer"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2019-3569-71c2432d",
        "digest": {
            "function_hash": "244793622532617888474407837374486565622",
            "length": 937.0
        },
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3569.json"