{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-45506", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-14T03:02:00.687231", "dateReserved": "2024-09-01T00:00:00", "datePublished": "2024-09-04T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-14T03:02:00.687231"}, "descriptions": [{"lang": "en", "value": "HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.haproxy.org/"}, {"url": "https://www.haproxy.org/download/3.1/src/CHANGELOG"}, {"url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45281.html"}, {"url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45280.html"}, {"url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3c"}, {"url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7f"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"affected": [{"vendor": "haproxy", "product": "haproxy", "cpes": ["cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.9.0", "status": "affected", "lessThan": "2.9.10", "versionType": "custom"}, {"version": "3.0.0", "status": "affected", "lessThan": "3.0.4", "versionType": "custom"}, {"version": "3.1.0", "status": "affected", "lessThan": "3.1-dev6", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-04T16:05:40.631435Z", "id": "CVE-2024-45506", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-09T19:01:27.998Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-45506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-04T16:05:40.631435Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*"], "vendor": "haproxy", "product": "haproxy", "versions": [{"status": "affected", "version": "2.9.0", "lessThan": "2.9.10", "versionType": "custom"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.4", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1-dev6", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T16:10:30.999Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.haproxy.org/"}, {"url": "https://www.haproxy.org/download/3.1/src/CHANGELOG"}, {"url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45281.html"}, {"url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45280.html"}, {"url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3c"}, {"url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7f"}], "descriptions": [{"lang": "en", "value": "HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-14T03:02:00.687231"}}}, "cveMetadata": {"cveId": "CVE-2024-45506", "state": "PUBLISHED", "dateUpdated": "2024-10-14T03:02:00.687231", "dateReserved": "2024-09-01T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-09-04T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "3636BFC5-4AAB-4C1B-A1D5-2388159DBEF0", "versionEndExcluding": "2.9.10", "versionStartIncluding": "2.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D1A5973-8D9C-4167-82E8-A6389BD555B1", "versionEndExcluding": "3.0.4", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:3.1:dev0:*:*:*:*:*:*", "matchCriteriaId": "3B98B170-D3B3-4527-B433-9A222A97B8B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:3.1:dev1:*:*:*:*:*:*", "matchCriteriaId": "0C7E5AC1-CC5F-4A72-9897-A91AD940643E", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:3.1:dev2:*:*:*:*:*:*", "matchCriteriaId": "57ED78DC-EB7E-487D-A588-594B7B1A067B", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:3.1:dev3:*:*:*:*:*:*", "matchCriteriaId": "04CA9989-DED9-48A5-B712-63CDCF32172F", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:3.1:dev4:*:*:*:*:*:*", "matchCriteriaId": "50441B9B-5388-451C-A895-2C18B2274079", "vulnerable": true}, {"criteria": "cpe:2.3:a:haproxy:haproxy:3.1:dev5:*:*:*:*:*:*", "matchCriteriaId": "4721433F-7E0C-4881-9439-16AA7E6E51D2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024."}, {"lang": "es", "value": "HAProxy 2.9.x antes de 2.9.10, 3.0.x antes de 3.0.4 y 3.1.x hasta 3.1-dev6 permiten una denegaci\u00f3n de servicio remota."}], "id": "CVE-2024-45506", "lastModified": "2024-10-14T03:15:10.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-09-04T15:15:14.080", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3c"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7f"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.haproxy.org/"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.haproxy.org/download/3.1/src/CHANGELOG"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45280.html"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45281.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "haproxy: potential infinite loop condition in the h2_send() may trigger a DoS", "id": "2309732", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309732"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.", "A flaw was found in HAProxy. An issue in the HTTP/2 multiplexer combined with the zero-copy forwarding system allows remote attackers to trigger under very rare conditions an endless loop and cause a denial of service."], "mitigation": {"lang": "en:us", "value": "Disable the zero-copy forwarding system to mitigate this issue. Add the following configuration directive in the global section:\n~~~\nglobal\n...\ntune.h2.zero-copy-fwd-send off\n~~~"}, "name": "CVE-2024-45506", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "haproxy", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2024-09-04T15:15:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-45506\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-45506\nhttps://git.haproxy.org/?p=haproxy-3.0.git;a=commitdiff;h=c725db17e8416ffb3c1537aea756356228ce5e3c\nhttps://git.haproxy.org/?p=haproxy-3.0.git;a=commitdiff;h=d636e515453320c6e122c313c661a8ac7d387c7f\nhttps://www.haproxy.com/blog/cve-2024-45506\nhttps://www.mail-archive.com/haproxy%40formilux.org/msg45280.html\nhttps://www.mail-archive.com/haproxy%40formilux.org/msg45281.html"], "statement": "The severity of this vulnerability has been raised to Important due to preliminary evidence from the upstream HAProxy project that it has been exploited in one case. Without this detail, the technical risk from this type of denial of service would have been rated Moderate.\nThis issue can only be triggered when zero-copy forwarding of data is enabled. See the mitigation section to see how this mechanism can be disabled.\nThe HAProxy package as shipped in Red Hat Enterprise Linux 7, 8, 9, in Red Hat Ceph Storage 5 and in Red Hat OpenShift Container Platform 3.11 and 4 is not affected by this vulnerability because these products do not ship a vulnerable version of HAProxy.", "threat_severity": "Important"}