SB2020042854 - Red Hat Enterprise Linux 8 update for haproxy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020042854

SB2020042854 - Red Hat Enterprise Linux 8 update for haproxy

Published: April 28, 2020

Security Bulletin ID SB2020042854
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2019-18277)

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

The vulnerability exists due to incorrect processing of messages with a missing transfer-encoding header, when HAProxy is configured in legacy mode. The server does not reject "chunked" value that combined with the "http-reuse always" setting can lead to HTTP request smuggling attack.


2) CRLF injection (CVE-ID: CVE-2019-19330)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing CRLF and NUL character in the HTTP request, while converting headers from HTTP/2 to HTTP/1. A remote attacker can send a specially crafted HTTP/2 request to the HAProxy and inject arbitrary HTTP headers. Successful exploitation of the vulnerability may allow an attacker to bypass certain security restrictions or perform spoofing attacks.


Remediation

Install update from vendor's website.

References