CVE-2020-11100

Name
CVE-2020-11100
Description
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Mailing List https://www.mail-archive.com/haproxy@formilux.org/msg36876.html
Mailing List https://lists.debian.org/debian-security-announce/2020/msg00052.html
Vendor Advisory http://www.haproxy.org
Release Notes https://www.haproxy.org/download/2.1/src/CHANGELOG
Patch https://git.haproxy.org/?p=haproxy.git;a=commit;h=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1819111
Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=1168023
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.html
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNW5RZLIX7LOXRLV7WMHX22CI43XSXKW/
DEBIAN https://www.debian.org/security/2020/dsa-4649
UBUNTU https://usn.ubuntu.com/4321-1/
MISC http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/264C7UL3X7L7QE74ZJ557IOUFS3J4QQC/
GENTOO https://security.gentoo.org/glsa/202012-22

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* haproxy >= 1.8.0 < 2.1.4

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
haproxy edge-main 2.1.4-r0 None fixed
haproxy 3.22-main 2.1.4-r0 None fixed
haproxy 3.21-main 2.1.4-r0 None fixed
haproxy 3.20-main 2.1.4-r0 None fixed
haproxy 3.19-main 2.1.4-r0 None fixed
haproxy 3.18-main 2.1.4-r0 None fixed
haproxy 3.17-main 2.1.4-r0 None fixed
haproxy 3.12-main 2.1.4-r0 None fixed
haproxy 3.11-main 2.0.25-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
haproxy 3.11-main 2.0.24-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
haproxy 3.11-main 2.0.24-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
haproxy 3.11-main 2.0.23-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
haproxy 3.11-main 2.0.22-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
haproxy 3.11-main 2.0.21-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
haproxy 3.11-main 2.0.14-r0 None fixed
haproxy 3.10-main 2.0.21-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
haproxy 3.10-main 2.0.14-r0 None fixed