{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-12-24T15:06:20", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.haproxy.org"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.haproxy.org/download/2.1/src/CHANGELOG"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://lists.debian.org/debian-security-announce/2020/msg00052.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg36876.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819111"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1168023"}, {"name": "openSUSE-SU-2020:0444", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.html"}, {"name": "FEDORA-2020-16cd111544", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNW5RZLIX7LOXRLV7WMHX22CI43XSXKW/"}, {"name": "DSA-4649", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2020/dsa-4649"}, {"name": "USN-4321-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4321-1/"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html"}, {"name": "FEDORA-2020-13fd8b1721", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/264C7UL3X7L7QE74ZJ557IOUFS3J4QQC/"}, {"name": "GLSA-202012-22", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/202012-22"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-11100", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.haproxy.org", "refsource": "MISC", "url": "http://www.haproxy.org"}, {"name": "https://www.haproxy.org/download/2.1/src/CHANGELOG", "refsource": "CONFIRM", "url": "https://www.haproxy.org/download/2.1/src/CHANGELOG"}, {"name": "https://lists.debian.org/debian-security-announce/2020/msg00052.html", "refsource": "CONFIRM", "url": "https://lists.debian.org/debian-security-announce/2020/msg00052.html"}, {"name": "https://www.mail-archive.com/haproxy@formilux.org/msg36876.html", "refsource": "CONFIRM", "url": "https://www.mail-archive.com/haproxy@formilux.org/msg36876.html"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1819111", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819111"}, {"name": "https://git.haproxy.org/?p=haproxy.git;a=commit;h=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88", "refsource": "CONFIRM", "url": "https://git.haproxy.org/?p=haproxy.git;a=commit;h=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88"}, {"name": "https://bugzilla.suse.com/show_bug.cgi?id=1168023", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1168023"}, {"name": "openSUSE-SU-2020:0444", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.html"}, {"name": "FEDORA-2020-16cd111544", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNW5RZLIX7LOXRLV7WMHX22CI43XSXKW/"}, {"name": "DSA-4649", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2020/dsa-4649"}, {"name": "USN-4321-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4321-1/"}, {"name": "http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html"}, {"name": "FEDORA-2020-13fd8b1721", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/264C7UL3X7L7QE74ZJ557IOUFS3J4QQC/"}, {"name": "GLSA-202012-22", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202012-22"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:21:14.619Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.haproxy.org"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.haproxy.org/download/2.1/src/CHANGELOG"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://lists.debian.org/debian-security-announce/2020/msg00052.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg36876.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819111"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1168023"}, {"name": "openSUSE-SU-2020:0444", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.html"}, {"name": "FEDORA-2020-16cd111544", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNW5RZLIX7LOXRLV7WMHX22CI43XSXKW/"}, {"name": "DSA-4649", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2020/dsa-4649"}, {"name": "USN-4321-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4321-1/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html"}, {"name": "FEDORA-2020-13fd8b1721", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/264C7UL3X7L7QE74ZJ557IOUFS3J4QQC/"}, {"name": "GLSA-202012-22", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/202012-22"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-11100", "datePublished": "2020-04-02T14:23:05", "dateReserved": "2020-03-30T00:00:00", "dateUpdated": "2024-08-04T11:21:14.619Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "2876323F-F324-48B3-BD7D-D559EA0E856E", "versionEndExcluding": "2.1.4", "versionStartIncluding": "1.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*", "matchCriteriaId": "2F87326E-0B56-4356-A889-73D026DB1D4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*", "matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*", "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution."}, {"lang": "es", "value": "En la funci\u00f3n hpack_dht_insert en el archivo hpack-tbl.c en el decodificador HPACK en HAProxy versiones 1.8 hasta 2.x anteriores a 2.1.4, un atacante remoto puede escribir bytes arbitrarios alrededor de una determinada ubicaci\u00f3n en la pila (heap) por medio de una petici\u00f3n HTTP/2 dise\u00f1ada, causando posiblemente una ejecuci\u00f3n de c\u00f3digo remoto."}], "id": "CVE-2020-11100", "lastModified": "2023-11-07T03:14:30.167", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-04-02T15:15:17.483", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.haproxy.org"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819111"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1168023"}, {"source": "cve@mitre.org", "url": "https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-security-announce/2020/msg00052.html"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/264C7UL3X7L7QE74ZJ557IOUFS3J4QQC/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNW5RZLIX7LOXRLV7WMHX22CI43XSXKW/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202012-22"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/4321-1/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2020/dsa-4649"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.haproxy.org/download/2.1/src/CHANGELOG"}, {"source": "cve@mitre.org", "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg36876.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the HAProxy project for reporting this issue. Upstream acknowledges Felix Wilhelm (Google Project Zero) as the original reporter.", "affected_release": [{"advisory": "RHSA-2020:1288", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "haproxy-0:1.8.15-6.el8_1.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2020-04-02T00:00:00Z"}, {"advisory": "RHSA-2020:1289", "cpe": "cpe:/a:redhat:rhel_e4s:8.0", "package": "haproxy-0:1.8.15-5.el8_0.1", "product_name": "Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions", "release_date": "2020-04-02T00:00:00Z"}, {"advisory": "RHSA-2020:1287", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "haproxy-0:1.8.23-3.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2020-04-07T00:00:00Z"}, {"advisory": "RHSA-2020:1936", "cpe": "cpe:/a:redhat:openshift:4.4::el7", "impact": "low", "package": "haproxy-0:2.0.13-3.el7", "product_name": "Red Hat OpenShift Container Platform 4.4", "release_date": "2020-05-04T00:00:00Z"}, {"advisory": "RHSA-2020:1290", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-haproxy18-haproxy-0:1.8.17-1.el7.1", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2020-04-02T00:00:00Z"}, {"advisory": "RHSA-2020:1290", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-haproxy18-haproxy-0:1.8.17-1.el7.1", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS", "release_date": "2020-04-02T00:00:00Z"}, {"advisory": "RHSA-2020:1290", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-haproxy18-haproxy-0:1.8.17-1.el7.1", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS", "release_date": "2020-04-02T00:00:00Z"}, {"advisory": "RHSA-2020:1290", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-haproxy18-haproxy-0:1.8.17-1.el7.1", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS", "release_date": "2020-04-02T00:00:00Z"}], "bugzilla": {"description": "haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes", "id": "1819111", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819111"}, "csaw": true, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-20->CWE-787", "details": ["In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.", "A flaw was found in the way HAProxy processed certain HTTP/2 request packets. This flaw allows an attacker to send crafted HTTP/2 request packets, which cause memory corruption, leading to a crash or potential remote arbitrary code execution with the permissions of the user running HAProxy."], "mitigation": {"lang": "en:us", "value": "This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/.\nYou can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'.\nTo mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy\nOn Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution."}, "name": "CVE-2020-11100", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2020-04-02T13:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-11100\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-11100\nhttps://bugs.chromium.org/p/project-zero/issues/detail?id=2023\nhttps://www.haproxy.com/blog/haproxy-1-8-http-2-hpack-decoder-vulnerability-fixed/\nhttps://www.mail-archive.com/haproxy@formilux.org/msg36876.html"], "statement": "HAProxy packages shipped with Red Hat Enterprise Linux 6 and 7 do not contain support for HTTP/2; therefore, they are not affected by this flaw.\nOpenShift Container Platform versions through 4.3 contain the vulnerable code; exploitation requires setting ROUTER_USE_HTTP2 in the OpenShift Ingress Operator, which is not currently possible. The impact of this vulnerability is therefore reduced in OCP 4.x, prior to version 4.4, to low.\nOpenShift Container Platform 3.11 added a configuration option to ose-haproxy-router that made enabling HTTP/2 support easy. However, it is not enabled by default on that version.", "threat_severity": "Critical", "upstream_fix": "haproxy 2.1.4"}