An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1436 advisory.

    HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments.

    The following packages have been upgraded to a later upstream version: rh-haproxy18-haproxy (1.8.17).
    (BZ#1660514)

    Security Fix(es):

    * haproxy: Infinite recursion via crafted packet allows stack exhaustion and denial of service     (CVE-2018-20103)

    * haproxy: Information disclosure in check_request_for_cacheability function in proto_http.c     (CVE-2018-11469)

    * haproxy: Out-of-bounds read in dns.c:dns_validate_dns_response() allows for memory disclosure     (CVE-2018-20102)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * ALPN is not enabled due to old OpenSSL dependancy (BZ#1595865)

    * HAProxy 1.8: Seamless reload does not work with send-/accept-proxy (BZ#1649041)

    Enhancement(s):

    * RFE : Haproxy does not resolve ipv6 resolvable hostnames in the backend section. (BZ#1575585)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.3 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3034 advisory.

  - An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due     to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes     corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything     that was left on the stack, or even past the end of the 8193-byte buffer, depending on the value of     accepted_payload_size. (CVE-2018-20102)

  - An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted     packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of     valid pointers resulting in stack exhaustion. (CVE-2018-20103)

  - A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header     missing the chunked value were not being correctly rejected. The impact was limited but if combined with     the http-reuse always setting, it could be used to help construct an HTTP request smuggling attack     against a vulnerable component employing a lenient parser that would ignore the content-length header as     soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).
    (CVE-2019-18277)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the haproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read in dns_validate_dns_response in     dns.c was discovered in HAProxy through 1.8.14. Due to     a missing check when validating DNS responses, remote     attackers might be able read the 16 bytes corresponding     to an AAAA record from the non-initialized part of the     buffer, possibly accessing anything that was left on     the stack, or even past the end of the 8193-byte     buffer, depending on the value of     accepted_payload_size.(CVE-2018-20102)

  - An issue was discovered in dns.c in HAProxy through     1.8.14. In the case of a compressed pointer, a crafted     packet can trigger infinite recursion by making the     pointer point to itself, or create a long chain of     valid pointers resulting in stack     exhaustion.(CVE-2018-20103)

  - An out-of-bounds read issue was discovered in the     HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x     through 1.9.0 which can result in a crash. The     processing of the PRIORITY flag in a HEADERS frame     requires 5 extra bytes, and while these bytes are     skipped, the total frame length was not re-checked to     make sure they were present in the     frame.(CVE-2018-20615)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - HAProxy is a TCP/HTTP reverse proxy which is     particularly suited for high availability environments.
    Indeed, it can: - route HTTP requests depending on     statically assigned cookies - spread load among several     servers while assuring server persistence through the     use of HTTP cookies - switch to backup servers in the     event a main one fails - accept connections to special     ports dedicated to service monitoring - stop accepting     connections without breaking existing ones - add,     modify, and delete HTTP headers in both directions -     block requests matching particular patterns - report     detailed status to authenticated users from a URI     intercepted from the applicationSecurity Fix(es):An     out-of-bounds read issue was discovered in the HTTP/2     protocol decoder in HAProxy 1.8.x and 1.9.x through     1.9.0 which can result in a crash. The processing of     the PRIORITY flag in a HEADERS frame requires 5 extra     bytes, and while these bytes are skipped, the total     frame length was not re-checked to make sure they were     present in the frame.(CVE-2018-20615)An issue was     discovered in dns.c in HAProxy through 1.8.14. In the     case of a compressed pointer, a crafted packet can     trigger infinite recursion by making the pointer point     to itself, or create a long chain of valid pointers     resulting in stack exhaustion.(CVE-2018-20103)An     out-of-bounds read in dns_validate_dns_response in     dns.c was discovered in HAProxy through 1.8.14. Due to     a missing check when validating DNS responses, remote     attackers might be able read the 16 bytes corresponding     to an AAAA record from the non-initialized part of the     buffer, possibly accessing anything that was left on     the stack, or even past the end of the 8193-byte     buffer, depending on the value of     accepted_payload_size.(CVE-2018-20102)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the haproxy package has been released.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3858-1 advisory.

    It was discovered that HAProxy incorrectly handled certain requests. An attacker could possibly use this     to expose sensitive information. (CVE-2018-20102)

    It was discovered that HAProxy incorrectly handled certain requests. A attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10.
    (CVE-2018-20103, CVE-2018-20615)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for haproxy to version 1.8.15 fixes the following issues :

Security issues fixed :

  - CVE-2018-20102: Fixed an out-of-bounds read in     dns_validate_dns_response(), which allowed for memory     disclosure (bsc#1119368)

  - CVE-2018-20103: Fixed an infinite recursion via crafted     packet allows stack exhaustion and denial of service     (bsc#1119419)

Other notable bug fixes :

  - Fix off-by-one write in dns_validate_dns_response()

  - Fix out-of-bounds read via signedness error in     dns_validate_dns_response()

  - Prevent out-of-bounds read in     dns_validate_dns_response()

  - Prevent out-of-bounds read in dns_read_name()

  - Prevent stack-exhaustion via recursion loop in     dns_read_name

For a full list of changes, please refer to:
https://www.haproxy.org/download/1.8/src/CHANGELOG

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Severity
194156	RHEL 7 : rh-haproxy18-haproxy (RHSA-2019:1436)	Nessus	Red Hat Local Security Checks	high
161700	Debian DLA-3034-1 : haproxy - LTS security update	Nessus	Debian Local Security Checks	high
131494	EulerOS Virtualization for ARM 64 3.0.3.0 : haproxy (EulerOS-SA-2019-2329)	Nessus	Huawei Local Security Checks	high
126277	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2019-1650)	Nessus	Huawei Local Security Checks	high
125157	Photon OS 1.0: Haproxy PHSA-2019-1.0-0220	Nessus	PhotonOS Local Security Checks	high
125087	Photon OS 2.0: Haproxy PHSA-2019-2.0-0150	Nessus	PhotonOS Local Security Checks	high
121210	Ubuntu 16.04 LTS / 18.04 LTS : HAProxy vulnerabilities (USN-3858-1)	Nessus	Ubuntu Local Security Checks	high
121153	openSUSE Security Update : haproxy (openSUSE-2019-44)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-20103

high

Tenable Plugins

high

high

high

high

high

high

high

high