An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0275 advisory.

    HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments.

    Security Fix(es):

    * haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash     (CVE-2018-20615)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the haproxy package has been released.

According to the versions of the haproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read in dns_validate_dns_response in     dns.c was discovered in HAProxy through 1.8.14. Due to     a missing check when validating DNS responses, remote     attackers might be able read the 16 bytes corresponding     to an AAAA record from the non-initialized part of the     buffer, possibly accessing anything that was left on     the stack, or even past the end of the 8193-byte     buffer, depending on the value of     accepted_payload_size.(CVE-2018-20102)

  - An issue was discovered in dns.c in HAProxy through     1.8.14. In the case of a compressed pointer, a crafted     packet can trigger infinite recursion by making the     pointer point to itself, or create a long chain of     valid pointers resulting in stack     exhaustion.(CVE-2018-20103)

  - An out-of-bounds read issue was discovered in the     HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x     through 1.9.0 which can result in a crash. The     processing of the PRIORITY flag in a HEADERS frame     requires 5 extra bytes, and while these bytes are     skipped, the total frame length was not re-checked to     make sure they were present in the     frame.(CVE-2018-20615)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - HAProxy is a TCP/HTTP reverse proxy which is     particularly suited for high availability environments.
    Indeed, it can: - route HTTP requests depending on     statically assigned cookies - spread load among several     servers while assuring server persistence through the     use of HTTP cookies - switch to backup servers in the     event a main one fails - accept connections to special     ports dedicated to service monitoring - stop accepting     connections without breaking existing ones - add,     modify, and delete HTTP headers in both directions -     block requests matching particular patterns - report     detailed status to authenticated users from a URI     intercepted from the applicationSecurity Fix(es):An     out-of-bounds read issue was discovered in the HTTP/2     protocol decoder in HAProxy 1.8.x and 1.9.x through     1.9.0 which can result in a crash. The processing of     the PRIORITY flag in a HEADERS frame requires 5 extra     bytes, and while these bytes are skipped, the total     frame length was not re-checked to make sure they were     present in the frame.(CVE-2018-20615)An issue was     discovered in dns.c in HAProxy through 1.8.14. In the     case of a compressed pointer, a crafted packet can     trigger infinite recursion by making the pointer point     to itself, or create a long chain of valid pointers     resulting in stack exhaustion.(CVE-2018-20103)An     out-of-bounds read in dns_validate_dns_response in     dns.c was discovered in HAProxy through 1.8.14. Due to     a missing check when validating DNS responses, remote     attackers might be able read the 16 bytes corresponding     to an AAAA record from the non-initialized part of the     buffer, possibly accessing anything that was left on     the stack, or even past the end of the 8193-byte     buffer, depending on the value of     accepted_payload_size.(CVE-2018-20102)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:0548 advisory.

  - haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash     (CVE-2018-20615)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0547 advisory.

  - haproxy: Out-of-bounds read in dns.c:dns_validate_dns_response() allows for memory disclosure     (CVE-2018-20102)

  - haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash     (CVE-2018-20615)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for haproxy version 1.8.17 fixes the following issues :

Security issues fixed :

  - CVE-2018-20615: Fixed a denial of service, triggered by     mishandling the priority flag on short HEADERS frame in     the HTTP/2 decoder (bsc#1121283)

This update was imported from the SUSE:SLE-15:Update update project.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3858-1 advisory.

    It was discovered that HAProxy incorrectly handled certain requests. An attacker could possibly use this     to expose sensitive information. (CVE-2018-20102)

    It was discovered that HAProxy incorrectly handled certain requests. A attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10.
    (CVE-2018-20103, CVE-2018-20615)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210297	RHEL 7 : rh-haproxy18-haproxy (RHSA-2019:0275)	Nessus	Red Hat Local Security Checks	high
203063	Photon OS 3.0: Haproxy PHSA-2019-3.0-0010	Nessus	PhotonOS Local Security Checks	high
131494	EulerOS Virtualization for ARM 64 3.0.3.0 : haproxy (EulerOS-SA-2019-2329)	Nessus	Huawei Local Security Checks	high
126277	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2019-1650)	Nessus	Huawei Local Security Checks	high
125089	Photon OS 1.0: Haproxy PHSA-2019-1.0-0226	Nessus	PhotonOS Local Security Checks	high
125087	Photon OS 2.0: Haproxy PHSA-2019-2.0-0150	Nessus	PhotonOS Local Security Checks	high
122866	RHEL 7 : OpenShift Container Platform 3.10 haproxy (RHSA-2019:0548)	Nessus	Red Hat Local Security Checks	high
122865	RHEL 7 : OpenShift Container Platform 3.9 haproxy (RHSA-2019:0547)	Nessus	Red Hat Local Security Checks	high
122179	openSUSE Security Update : haproxy (openSUSE-2019-166)	Nessus	SuSE Local Security Checks	high
121210	Ubuntu 16.04 LTS / 18.04 LTS : HAProxy vulnerabilities (USN-3858-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-20615

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high