CVE-2019-3569

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2019-3569

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3569.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2019-3569

Downstream

UBUNTU-CVE-2019-3569

Published

2019-06-26T15:15:09Z

Modified

2026-11-04T07:07:04Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.

References

Affected packages

Git / github.com/meta/hhvm

Affected ranges

Type

GIT

Repo

https://github.com/meta/hhvm

Events

Introduced

Last Affected

c3ef837b239cb6b83b6f18ce7476b9d4858bf5fb

Introduced

7d4f701b9ed004452d695fce4e1ef8f48babbf39

Last Affected

8ca4f914698d694c39cbfcd4f607f0e5cd64e705

Fixed

97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "3.30.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.0.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.0.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.0.1:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.1"
                },
                {
                    "last_affected": "4.0.1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.0.2:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.2"
                },
                {
                    "last_affected": "4.0.2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.0.3:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.3"
                },
                {
                    "last_affected": "4.0.3"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.0.4:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.4"
                },
                {
                    "last_affected": "4.0.4"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.1.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "4.1.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.2.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.2.0"
                },
                {
                    "last_affected": "4.2.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.3.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.3.0"
                },
                {
                    "last_affected": "4.3.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.4.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.4.0"
                },
                {
                    "last_affected": "4.4.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.5.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.6.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.6.0"
                },
                {
                    "last_affected": "4.6.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.7.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.7.0"
                },
                {
                    "last_affected": "4.7.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:facebook:hhvm:4.8.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.8.0"
                },
                {
                    "last_affected": "4.8.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "range": [
                {
                    "fixed": "97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.1.0

4.2.0

4.3.0

4.4.0

4.5.0

4.6.0

4.7.0

4.8.0

HHVM-3.*

HHVM-3.30.0

HHVM-3.30.1

HHVM-3.30.2

HHVM-3.30.3

HHVM-3.30.4

HHVM-3.30.5

HHVM-4.*

HHVM-4.8.0

HPHP-2.*

HPHP-2.1.0

gcc-4.*

gcc-4.6

nightly-2019.*

nightly-2019.03.28

nightly-2019.03.29

nightly-2019.03.30

nightly-2019.03.31

nightly-2019.04.01

nightly-2019.04.02

nightly-2019.04.03

nightly-2019.04.04

nightly-2019.04.05

nightly-2019.04.06

nightly-2019.04.07

nightly-2019.04.08

nightly-2019.04.09

nightly-2019.04.10

nightly-2019.04.11

nightly-2019.04.12

nightly-2019.04.13

nightly-2019.04.14

nightly-2019.04.15

nightly-2019.04.16

nightly-2019.04.17

nightly-2019.04.18

nightly-2019.04.19

nightly-2019.04.20

nightly-2019.04.21

nightly-2019.04.22

nightly-2019.04.23

nightly-2019.04.24

nightly-2019.04.25

nightly-2019.04.26

nightly-2019.04.27

nightly-2019.04.28

nightly-2019.04.29

nightly-2019.04.30

nightly-2019.05.01

nightly-2019.05.02

nightly-2019.05.03

nightly-2019.05.04

nightly-2019.05.05

nightly-2019.05.06

nightly-2019.05.07

nightly-2019.05.08

nightly-2019.05.09

nightly-2019.05.10

nightly-2019.05.11

nightly-2019.05.12

nightly-2019.05.13

nightly-2019.05.14

nightly-2019.05.15

nightly-2019.05.16

nightly-2019.05.17

nightly-2019.05.18

nightly-2019.05.19

nightly-2019.05.20

nightly-2019.05.21

nightly-2019.05.22

nightly-2019.05.23

nightly-2019.05.24

nightly-2019.05.25

nightly-2019.05.26

nightly-2019.05.27

nightly-2019.05.28

nightly-2019.05.29

nightly-2019.05.30

nightly-2019.05.31

nightly-2019.06.01

nightly-2019.06.02

nightly-2019.06.03

nightly-2019.06.04

nightly-2019.06.05

nightly-2019.06.06

nightly-2019.06.07

nightly-2019.06.08

nightly-2019.06.09

nightly-2019.06.10

nightly-2019.06.11

Other

pre-hhvm

src-hphp

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3569.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "137514824064723355843894764939851756089",
                "274485221879760134909049791648411818110",
                "142983643094198605564629967646232518446",
                "6111575993008610184694406316844627987"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2019-3569-41fd61cd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/meta/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed",
        "target": {
            "file": "hphp/runtime/server/fastcgi/fastcgi-server.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "244793622532617888474407837374486565622",
            "length": 937
        },
        "id": "CVE-2019-3569-ab67b3f1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/meta/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed",
        "target": {
            "file": "hphp/runtime/server/fastcgi/fastcgi-server.cpp",
            "function": "FastCGIServer::FastCGIServer"
        }
    }
]

vanir_signatures_modified

"2026-11-04T07:07:04Z"