The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-1725 advisory.

    - Fix hapack zero byte input causing overwrite (CVE-2020-11100, #1819519)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1287 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2265 advisory.

    HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments.

    The following packages have been upgraded to a later upstream version: rh-haproxy18-haproxy (1.8.24).
    (BZ#1774747)

    Security Fix(es):

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.5 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:1725 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the haproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The HTTP/2 implementation in HAProxy before 2.0.10     mishandles headers, as demonstrated by carriage return     (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the     zero character (NUL, ASCII 0x0), aka Intermediary     Encapsulation Attacks.(CVE-2019-19330)

  - A flaw was found in HAProxy before 2.0.6. In legacy     mode, messages featuring a transfer-encoding header     missing the 'chunked' value were not being correctly     rejected. The impact was limited but if combined with     the 'http-reuse always' setting, it could be used to     help construct an HTTP request smuggling attack against     a vulnerable component employing a lenient parser that     would ignore the content-length header as soon as it     saw a transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2019-18277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The HTTP/2 implementation in HAProxy before 2.0.10     mishandles headers, as demonstrated by carriage return     (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the     zero character (NUL, ASCII 0x0), aka Intermediary     Encapsulation Attacks.(CVE-2019-19330)

  - A flaw was found in HAProxy before 2.0.6. In legacy     mode, messages featuring a transfer-encoding header     missing the 'chunked' value were not being correctly     rejected. The impact was limited but if combined with     the 'http-reuse always' setting, it could be used to     help construct an HTTP request smuggling attack against     a vulnerable component employing a lenient parser that     would ignore the content-length header as soon as it     saw a transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2019-18277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1936 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * haproxy: malformed HTTP/2 requests could lead to out-of-bounds writes (CVE-2020-11100)

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation was vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1725 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    The following packages have been upgraded to a later upstream version: haproxy (1.8.23). (BZ#1774745)

    Security Fix(es):

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202004-01 (HAProxy: Remote execution of arbitrary code)

    It was discovered that HAProxy incorrectly handled certain HTTP/2       headers.
  Impact :

    A remote attacker could send a specially crafted HTTP/2 header, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update of the haproxy package has been released.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4212-1 advisory.

    Tim Dsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers. An attacker could     possibly use this issue to execute arbitrary code through CRLF injection.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Tim Dusterhus discovered that haproxy, a TCP/HTTP reverse proxy, did not properly sanitize HTTP headers when converting from HTTP/2 to HTTP/1. This would allow a remote user to perform CRLF injections.

ID	Name	Product	Family	Severity
180906	Oracle Linux 8 : haproxy (ELSA-2020-1725)	Nessus	Oracle Linux Local Security Checks	critical
170348	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:1287)	Nessus	Red Hat Local Security Checks	critical
170315	RHEL 7 : rh-haproxy18-haproxy (RHSA-2020:2265)	Nessus	Red Hat Local Security Checks	critical
145810	CentOS 8 : haproxy (CESA-2020:1725)	Nessus	CentOS Local Security Checks	critical
140007	EulerOS Virtualization for ARM 64 3.0.6.0 : haproxy (EulerOS-SA-2020-1904)	Nessus	Huawei Local Security Checks	critical
139135	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2020-1805)	Nessus	Huawei Local Security Checks	critical
136319	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 haproxy (RHSA-2020:1936)	Nessus	Red Hat Local Security Checks	critical
136052	RHEL 8 : haproxy (RHSA-2020:1725)	Nessus	Red Hat Local Security Checks	critical
135112	GLSA-202004-01 : HAProxy: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
133064	Photon OS 3.0: Haproxy PHSA-2020-3.0-0047	Nessus	PhotonOS Local Security Checks	critical
132965	Photon OS 1.0: Haproxy PHSA-2019-1.0-0263	Nessus	PhotonOS Local Security Checks	critical
131722	Ubuntu 18.04 LTS : HAProxy vulnerability (USN-4212-1)	Nessus	Ubuntu Local Security Checks	critical
131438	Debian DSA-4577-1 : haproxy - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-19330

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical