Heap-based buffer overflow in HAProxy - CVE-2020-11100

Vulnerability identifier: #VU26549

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-11100

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTTP/2 requests within the hpack_dht_insert() function in hpack-tbl.c (HPACK decoder). A remote attacker can send a specially crafted HTTP/2 request to the affected HAProxy, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

HAProxy
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Opensuse
openEuler
Fedora
Red Hat Software Collections
rh-haproxy18-haproxy (Red Hat package)
haproxy (Alpine package)
haproxy (Ubuntu package)
haproxy (Debian package)
haproxy (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
haproxy-help
haproxy-debugsource
haproxy-debuginfo
haproxy
Red Hat OpenShift Container Platform
IBM Security Verify Access

Install updates from vendor's website.

HAProxy - addressed in versions 1.8.25, 1.9.15, 2.0.14, 2.1.4
rh-haproxy18-haproxy (Red Hat package) - update to 1.8.17-1.el7
haproxy (Alpine package) - update to 1.8.25-r0
haproxy (Ubuntu package) - addressed in versions 1.8.8-1ubuntu0.10, 2.0.5-1ubuntu0.4
haproxy (Debian package) - update to 1.8.19-1+deb10u2
haproxy (Red Hat package) - addressed in versions 1.8.15-5.el8_0.1, 1.8.15-6.el8_1.1, 1.8.23-3.el7, 2.0.13-3.el7, 2.0.13-3.el8
Red Hat OpenShift Container Platform - addressed in versions 3.11.0, 4.4.3
haproxy-help - update to 1.8.14-5
haproxy-debugsource - update to 1.8.14-5
haproxy-debuginfo - update to 1.8.14-5
haproxy - update to 1.8.14-5
haproxy - addressed in versions 1.8.25-1.fc30, 2.0.14-1.fc31
IBM Security Verify Access - update to 10.0.7.0

• http://www.haproxy.org
• https://bugzilla.redhat.com/show_bug.cgi?id=1819111
• https://git.haproxy.org/?p=haproxy.git;a=commit;h=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88
• https://lists.debian.org/debian-security-announce/2020/msg00052.html
• https://www.haproxy.org/download/2.1/src/CHANGELOG
• https://www.mail-archive.com/haproxy@formilux.org/msg36876.html

• Remote code execution in HAProxy
• Red Hat Enterprise Linux 8 update for haproxy
• Red Hat Enterprise Linux 8 update for haproxy
• Red Hat Software Collections 1 update for rh-haproxy18-haproxy
• OpenSUSE Linux update for haproxy
• Ubuntu update for HAProxy
• Arch Linux update for haproxy
• Debian update for haproxy
• Red Hat update for OpenShift Container Platform 4.4.3 haproxy
• Heap-based buffer overflow in haproxy (Alpine package)
• Gentoo update for HAProxy
• Multiple vulnerabilities in IBM Security Verify Access
• openEuler 20.03 LTS update for haproxy-1.8.14-5
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 3
• Fedora 31 update for haproxy
• Fedora 30 update for haproxy