VULNERABILITY INTELLIGENCE

CVE-2020-1921

CVSS score7.5 HIGH

EPSS probability1.21%

CISA KEVNot currently listed

Published2021-03-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

Weakness classification

cve-assign@fb.com: CWE-121
nvd@nist.gov: CWE-787

Primary references

cve-assign@fb.com — Patch, Third Party Advisory
cve-assign@fb.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory