Red Hat Security AdvisoryRHSA-2020:1936
OpenShift Container Platform 4.4.3 haproxy security update
Released 2020-05-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.4 haproxy-2.0.13-3.el7, haproxy-2.0.13-3.el8, haproxy20-2.0.13-3.el7 +1
Fixes 3 records
Priority HIGH 73
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly ca…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.61593 · Published 2020-04-02 · Fixed CWE-787
Priority MEDIUM 49
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulatio…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04032 · Published 2019-11-27 · Fixed CWE-74
Priority MEDIUM 45
A flaw was found in HAProxy before 2.0.6.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.10068 · Published 2019-10-23 · Partial fix CWE-444
