A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2882 advisory.

    HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments.

    Security Fix(es):

    * haproxy: Out-of-bounds read in HPACK decoder (CVE-2018-14645)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Tim Dsterhus and Willy Tarreau for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for haproxy to version 1.8.14 fixes the following issues :

These security issues were fixed :

  - CVE-2018-14645: A flaw was discovered in the HPACK     decoder what caused an out-of-bounds read in     hpack_valid_idx() that resulted in a remote crash and     denial of service (bsc#1108683)

  - CVE-2018-11469: Incorrect caching of responses to     requests including an Authorization header allowed     attackers to achieve information disclosure via an     unauthenticated remote request (bsc#1094846).

These non-security issues were fixed :

  - Require apparmor-abstractions to reduce dependencies     (bsc#1100787)

  - hpack: fix improper sign check on the header index value

  - cli: make sure the 'getsock' command is only called on     connections

  - tools: fix set_net_port() / set_host_port() on IPv4

  - patterns: fix possible double free when reloading a     pattern list

  - server: Crash when setting FQDN via CLI.

  - kqueue: Don't reset the changes number by accident.

  - snapshot: take the proxy's lock while dumping errors

- http/threads: atomically increment the error snapshot ID

  - dns: check and link servers' resolvers right after     config parsing

  - h2: fix risk of memory leak on malformated wrapped     frames

  - session: fix reporting of handshake processing time in     the logs

  - stream: use atomic increments for the request counter

  - thread: implement HA_ATOMIC_XADD()

  - ECC cert should work with TLS < v1.2 and openssl >=     1.1.1

  - dns/server: fix incomatibility between SRV resolution     and server state file

  - hlua: Don't call RESET_SAFE_LJMP if SET_SAFE_LJMP     returns 0.

  - thread: lua: Wrong SSL context initialization.

  - hlua: Make sure we drain the output buffer when done.

  - lua: reset lua transaction between http requests

  - mux_pt: dereference the connection with care in     mux_pt_wake()

  - lua: Bad HTTP client request duration.

  - unix: provide a ->drain() function

  - Fix spelling error in configuration doc

  - cli/threads: protect some server commands against     concurrent operations

  - cli/threads: protect all 'proxy' commands against     concurrent updates

  - lua: socket timeouts are not applied

  - ssl: Use consistent naming for TLS protocols

  - dns: explain set server ... fqdn requires resolver

  - map: fix map_regm with backref

  - ssl: loading dh param from certifile causes     unpredictable error.

  - ssl: fix missing error loading a keytype cert from a     bundle.

  - ssl: empty connections reported as errors.

  - cli: make 'show fd' thread-safe

  - hathreads: implement a more flexible rendez-vous point

  - threads: fix the no-thread case after the change to the     sync point

  - threads: add more consistency between certain variables     in no-thread case

  - threads: fix the double CAS implementation for ARMv7

  - threads: Introduce double-width CAS on x86_64 and arm.

  - lua: possible CLOSE-WAIT state with '\n' headers

For additional changes please refer to the changelog.

This update was imported from the SUSE:SLE-15:Update update project.

Update to 1.8.14, which includes fix for CVE-2018-14645.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2709 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.10.66. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2018:2824

    Security Fix(es):

    * atomic-openshift: oc patch with json causes masterapi service crash (CVE-2018-14632)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Lars Haugan for reporting this issue.

    All OpenShift Container Platform 3.10 users are advised to upgrade to these updated packages and images.

    Bug Fix(es):

    * During etcd scaleup, facts about the etcd cluster are required to add new hosts. This bug fix adds the     necessary tasks to ensure those facts get set before configuring new hosts, and therefore, allow the     scaleup to complete as expected. (BZ#1578482)

    * Previously, sync pod was not available when the Prometheus install checked for available nodes. As a     consequence, if a custom label was used for the Prometheus install to select an appropriate node, the sync     pods must have already applied the label to the nodes. Otherwise, the Prometheus installer would not find     any nodes with a matching label. This bug fix adds a check to the install process to wait for sync pods to     become available before continuing. As a result, the node labeling process will complete, and the nodes     will have the correct labels for the Prometheus pod to be scheduled. (BZ#1609019)

    * This bug fix corrects an issue where a pod is stuck terminating due to I/O errors on a FlexVolume     mounted on the XFS file system. (BZ#1626054)

    * Previously, fluentd generated events internally with the `OneEventStream` class. This class does not     have the `empty?` method. The Kubernetes metadata filter used the `empty?` method on the `EventStream`     object to avoid processing an empty stream. Fluentd issued error messages about the missing `empty?`     method, which overwhelmed container logging and caused disk issues. This bug fix changed the Kubernetes     metadata filter only to call the `empty?` method on objects that have this method. As a result,     fluentd logs do not contain this message. (BZ#1626552)

    * RubyGems FFI 1.9.25 reverted a patch which allowed it to work on systems with `SELinux deny_execmem=1`.
    This reversion caused fluentd to crash. This bug reverts the patch reversion. As a result, fluentd does     not crash when using `SELinux deny_execmem=1`. (BZ#1628405)

    * This bug fix updates the *_redeploy-openshift-ca.yml_* playbook to reference the correct node client     certificate file, `node/client-ca.crt`. (BZ#1628546)

    * The fix for BZ1628371 introduced a poorly built shared library with a missing symbol. This missing     symbol caused fluentd to crash with an undefined symbol: rbffi_Closure_Alloc error message. This bug fix     rebuilds the shared library with the correct symbols. As a result, fluentd does not crash. (BZ#1628798)

    * Previously, when using Docker with the journald log driver, all container logs, including system and     plain Docker container logs, were logged to the journal, and read by fluentd. Fluentd did not know how to     handle these non-Kubernetes container logs and threw exceptions. This bug fix treats non-Kubernetes     container logs as logs from other system services, for example, sending them to the .operations.* index.
    As a result, logs from     non-Kubernetes containers are indexed correctly and do not cause any errors. (BZ#1632361)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3780-1 advisory.

    It was discovered that HAProxy incorrectly handled certain requests. An attacker could possibly use this     issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210295	RHEL 7 : rh-haproxy18-haproxy (RHSA-2018:2882)	Nessus	Red Hat Local Security Checks	high
123348	openSUSE Security Update : haproxy (openSUSE-2019-824)	Nessus	SuSE Local Security Checks	medium
120351	Fedora 28 : haproxy (2018-381ab64b59)	Nessus	Fedora Local Security Checks	high
120225	Fedora 29 : haproxy (2018-0b038c7047)	Nessus	Fedora Local Security Checks	high
119405	RHEL 7 : Red Hat OpenShift Container Platform 3.10 (RHSA-2018:2709)	Nessus	Red Hat Local Security Checks	high
118344	openSUSE Security Update : haproxy (openSUSE-2018-1229)	Nessus	SuSE Local Security Checks	medium
117904	Ubuntu 18.04 LTS : HAProxy vulnerability (USN-3780-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-14645

high

Tenable Plugins

high

medium

high

high

high

medium

high