In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.

An update of the haproxy package has been released.

The version of haproxy2 installed on the remote host is prior to 2.1.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-006 advisory.

  - In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote     attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request,     possibly causing remote code execution. (CVE-2020-11100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1287 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1290 advisory.

    HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments.

    Security Fix(es):

    * haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1288 advisory.

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202012-22 (HAProxy: Arbitrary code execution)

    It was discovered that HAProxy incorrectly handled certain HTTP/2       headers.
  Impact :

    A remote attacker, by sending a specially crafted HTTP/2 request, could       possibly execute arbitrary code with the privileges of the process, or       cause a Denial of Service condition.
  Workaround :

    Disable HTTP/2 support.

According to the version of the haproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In hpack_dht_insert in hpack-tbl.c in the HPACK decoder     in HAProxy 1.8 through 2.x before 2.1.4, a remote     attacker can write arbitrary bytes around a certain     location on the heap via a crafted HTTP/2 request,     possibly causing remote code execution.(CVE-2020-11100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In hpack_dht_insert in hpack-tbl.c in the HPACK decoder     in HAProxy 1.8 through 2.x before 2.1.4, a remote     attacker can write arbitrary bytes around a certain     location on the heap via a crafted HTTP/2 request,     possibly causing remote code execution.(CVE-2020-11100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1936 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * haproxy: malformed HTTP/2 requests could lead to out-of-bounds writes (CVE-2020-11100)

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation was vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2020-11100)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Felix Wilhelm of Google Project Zero discovered that HAProxy, a TCP/HTTP reverse proxy, did not properly handle HTTP/2 headers. This would allow an attacker to write arbitrary bytes around a certain location on the heap, resulting in denial-of-service or potential arbitrary code execution.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4321-1 advisory.

    Felix Wilhelm discovered that HAProxy incorrectly handled certain HTTP/2 requests. An attacker could     possibly use this to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for haproxy fixes the following issues :

  - CVE-2020-11100: Fixed an H2/HPAC vulnerability ch might     have allowed arbitrary writes into a 32-bit relative     address space (bsc#1168023).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1288 advisory.

    - - Fix hapack zero byte input causing overwrite (CVE-2020-11100, #1819518)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The HAproxy Project reports :

The main driver for this release is that it contains a fix for a serious vulnerability that was responsibly reported last week by Felix Wilhelm from Google Project Zero, affecting the HPACK decoder used for HTTP/2. CVE-2020-11100 was assigned to this issue.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1289 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1288 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203105	Photon OS 2.0: Haproxy PHSA-2020-2.0-0227	Nessus	PhotonOS Local Security Checks	high
181985	Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-006)	Nessus	Amazon Linux Local Security Checks	high
170348	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:1287)	Nessus	Red Hat Local Security Checks	critical
170290	RHEL 7 : rh-haproxy18-haproxy (RHSA-2020:1290)	Nessus	Red Hat Local Security Checks	high
146014	CentOS 8 : haproxy (CESA-2020:1288)	Nessus	CentOS Local Security Checks	high
144610	GLSA-202012-22 : HAProxy: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
137816	EulerOS Virtualization for ARM 64 3.0.6.0 : haproxy (EulerOS-SA-2020-1709)	Nessus	Huawei Local Security Checks	high
136858	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2020-1580)	Nessus	Huawei Local Security Checks	high
136319	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 haproxy (RHSA-2020:1936)	Nessus	Red Hat Local Security Checks	critical
136032	Photon OS 1.0: Haproxy PHSA-2020-1.0-0289	Nessus	PhotonOS Local Security Checks	high
135781	Photon OS 3.0: Haproxy PHSA-2020-3.0-0078	Nessus	PhotonOS Local Security Checks	high
135418	Fedora 30 : haproxy (2020-16cd111544)	Nessus	Fedora Local Security Checks	high
135416	Debian DSA-4649-1 : haproxy - security update	Nessus	Debian Local Security Checks	high
135282	Ubuntu 18.04 LTS : HAProxy vulnerability (USN-4321-1)	Nessus	Ubuntu Local Security Checks	high
135220	openSUSE Security Update : haproxy (openSUSE-2020-444)	Nessus	SuSE Local Security Checks	high
135217	Oracle Linux 8 : haproxy (ELSA-2020-1288)	Nessus	Oracle Linux Local Security Checks	high
135192	FreeBSD : HAproxy -- serious vulnerability affecting the HPACK decoder used for HTTP/2 (7f829d44-7509-11ea-b47c-589cfc0f81b0)	Nessus	FreeBSD Local Security Checks	high
135184	RHEL 8 : haproxy (RHSA-2020:1289)	Nessus	Red Hat Local Security Checks	high
135183	RHEL 8 : haproxy (RHSA-2020:1288)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-11100

high

Tenable Plugins

high

high

critical

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high