Vulnerability Name:

CVE-2020-11100 (CCN-179260)

Assigned:2020-04-02
Published:2020-04-02
Updated:2022-10-06
Summary:In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-787
CWE-787
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2020-11100

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2020:0444

Source: MISC
Type: Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html

Source: MISC
Type: Vendor Advisory
http://www.haproxy.org

Source: CCN
Type: Red Hat Bugzilla – Bug 1819111
(CVE-2020-11100) - CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1819111

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1168023

Source: XF
Type: UNKNOWN
haproxy-cve202011100-code-exec(179260)

Source: CCN
Type: HAProxy GIT Repository
hpack: never index a header into the headroom after wrapping

Source: CONFIRM
Type: Patch, Vendor Advisory
https://git.haproxy.org/?p=haproxy.git;a=commit;h=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88

Source: CONFIRM
Type: Mailing List, Third Party Advisory
https://lists.debian.org/debian-security-announce/2020/msg00052.html

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-13fd8b1721

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-16cd111544

Source: CCN
Type: Packet Storm Security [04-21-2020]
haproxy hpack-tbl.c Out-Of-Bounds Write

Source: GENTOO
Type: Third Party Advisory
GLSA-202012-22

Source: UBUNTU
Type: Third Party Advisory
USN-4321-1

Source: DEBIAN
Type: Third Party Advisory
DSA-4649

Source: CONFIRM
Type: Release Notes, Vendor Advisory
https://www.haproxy.org/download/2.1/src/CHANGELOG

Source: CCN
Type: IBM Security Bulletin 6380938 (Aspera High-Speed Transfer Server)
HAProxy vulnerability CVE-2020-11100 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0

Source: CONFIRM
Type: Mailing List, Third Party Advisory
https://www.mail-archive.com/haproxy@formilux.org/msg36876.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:haproxy:haproxy:*:*:*:*:*:*:*:* (Version >= 1.8.0 and < 2.1.4)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:31:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:haproxy:haproxy:1.8.7:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:1.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:1.8.9:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:1.8.13:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:1.8.14:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:1.9.6:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:1.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:1.8.16:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:haproxy:haproxy:2.0.9:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:202011100
    V
    		CVE-2020-11100
    2022-09-02
    oval:org.opensuse.security:def:4300
    P
    		Security update for the Linux Kernel (Important)
    2022-07-13
    oval:org.opensuse.security:def:112392
    P
    		haproxy-2.4.4+git0.acb1d0bea-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:4241
    P
    		Security update for libaom (Moderate)
    2021-12-23
    oval:org.opensuse.security:def:4240
    P
    		Security update for openssh (Important)
    2021-12-22
    oval:org.opensuse.security:def:4284
    P
    		Security update for samba (Important)
    2021-11-10
    oval:org.opensuse.security:def:4227
    P
    		Security update for flatpak (Important)
    2021-10-20
    oval:org.opensuse.security:def:4282
    P
    		Security update for the Linux Kernel (Important)
    2021-10-12
    oval:org.opensuse.security:def:105902
    P
    		haproxy-2.4.4+git0.acb1d0bea-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:5124
    P
    		Security update for sqlite3 (Important)
    2021-09-23
    oval:org.opensuse.security:def:4219
    P
    		Security update for ffmpeg (Important)
    2021-09-23
    oval:org.opensuse.security:def:5102
    P
    		Security update for libesmtp (Important)
    2021-09-02
    oval:org.opensuse.security:def:74659
    P
    		Security update for go1.16 (Moderate)
    2021-08-20
    oval:org.opensuse.security:def:4464
    P
    		Security update for the Linux Kernel (Important)
    2021-08-10
    oval:org.opensuse.security:def:63496
    P
    		libsybdb5-1.1.36-3.3.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62822
    P
    		perl-File-Path-2.150000-1.22 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62794
    P
    		libkpathsea6-6.2.3-19.4 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62790
    P
    		libimobiledevice-devel-1.2.0+git20180427.26373b3-1.40 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62797
    P
    		libmicrohttpd-devel-0.9.57-1.33 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63000
    P
    		cross-nvptx-gcc7-7.5.0+r278197-4.25.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:4460
    P
    		Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP5) (Important)
    2021-07-27
    oval:org.opensuse.security:def:4456
    P
    		Security update for the Linux Kernel (Live Patch 14 for SLE 12 SP5) (Important)
    2021-07-27
    oval:org.opensuse.security:def:4449
    P
    		Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP5) (Important)
    2021-07-23
    oval:org.opensuse.security:def:5081
    P
    		Security update for curl (Moderate)
    2021-07-23
    oval:org.opensuse.security:def:64547
    P
    		Security update for the Linux Kernel (Important)
    2021-07-21
    oval:org.opensuse.security:def:4199
    P
    		Security update for wireshark (Important)
    2021-06-22
    oval:org.opensuse.security:def:69492
    P
    		Security update for Salt (Critical)
    2021-06-21
    oval:org.opensuse.security:def:4423
    P
    		Security update for the Linux Kernel (Live Patch 8 for SLE 12 SP5) (Important)
    2021-06-18
    oval:org.opensuse.security:def:64717
    P
    		Security update for python-urllib3 (Important)
    2021-06-18
    oval:org.opensuse.security:def:5059
    P
    		Security update for caribou (Important)
    2021-06-10
    oval:org.opensuse.security:def:4417
    P
    		Security update for the Linux Kernel (Live Patch 9 for SLE 12 SP5) (Important)
    2021-05-25
    oval:org.opensuse.security:def:4413
    P
    		Security update for the Linux Kernel (Live Patch 13 for SLE 12 SP5) (Important)
    2021-05-25
    oval:org.opensuse.security:def:4421
    P
    		Security update for the Linux Kernel (Live Patch 5 for SLE 12 SP5) (Important)
    2021-05-25
    oval:org.opensuse.security:def:4272
    P
    		Security update for the Linux Kernel (Important)
    2021-05-13
    oval:org.opensuse.security:def:4406
    P
    		Security update for the Linux Kernel (Live Patch 16 for SLE 12 SP5) (Important)
    2021-04-28
    oval:org.opensuse.security:def:4403
    P
    		Security update for the Linux Kernel (Live Patch 13 for SLE 12 SP5) (Important)
    2021-04-28
    oval:org.opensuse.security:def:4381
    P
    		Security update for the Linux Kernel (Live Patch 5 for SLE 12 SP5) (Important)
    2021-04-07
    oval:org.opensuse.security:def:69597
    P
    		Security update for java-1_8_0-ibm (Important)
    2021-03-01
    oval:org.opensuse.security:def:4178
    P
    		Security update for jasper (Important)
    2021-02-16
    oval:org.opensuse.security:def:64605
    P
    		Security update for the Linux Kernel (Important)
    2021-02-09
    oval:org.opensuse.security:def:4186
    P
    		Security update for ImageMagick (Moderate)
    2021-01-12
    oval:org.opensuse.security:def:64445
    P
    		Security update for openssh (Moderate)
    2020-12-09
    oval:org.opensuse.security:def:4361
    P
    		Security update for the Linux Kernel (Live Patch 0 for SLE 12 SP5) (Important)
    2020-12-07
    oval:org.opensuse.security:def:63643
    P
    		strongswan-nm-5.8.2-9.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63293
    P
    		postgresql-contrib-12-2.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4326
    P
    		Security update for the Linux Kernel (Live Patch 14 for SLE 15) (Important)
    2020-12-02
    oval:org.opensuse.security:def:4314
    P
    		Security update for the Linux Kernel (Live Patch 3 for SLE 15) (Important)
    2020-12-02
    oval:org.opensuse.security:def:4342
    P
    		Security update for the Linux Kernel (Live Patch 14 for SLE 15) (Important)
    2020-12-02
    oval:org.opensuse.security:def:64201
    P
    		ruby2.5-rubygem-rack on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:74792
    P
    		Security update for haproxy (Important)
    2020-12-01
    oval:org.opensuse.security:def:63872
    P
    		Security update for ovmf (Important)
    2020-12-01
    oval:org.opensuse.security:def:66261
    P
    		Security update for haproxy (Important)
    2020-12-01
    oval:org.opensuse.security:def:72950
    P
    		Security update for haproxy (Important)
    2020-12-01
    oval:org.opensuse.security:def:66169
    P
    		Security update for rmt-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:72832
    P
    		Security update for virglrenderer (Important)
    2020-12-01
    oval:org.opensuse.security:def:64338
    P
    		libjbig-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:64337
    P
    		libjavascriptcoregtk-4_0-18 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:110454
    P
    		Security update for haproxy (Important)
    2020-04-04
    oval:com.redhat.rhsa:def:20201288
    P
    		RHSA-2020:1288: haproxy security update (Critical)
    2020-04-02
    oval:org.opensuse.security:def:91868
    P
    		Security update for haproxy (Important)
    2020-04-02
    oval:org.opensuse.security:def:98818
    P
    		Security update for haproxy (Important)
    2020-04-02
    BACK
    haproxy haproxy *
    debian debian linux 10.0
    redhat openshift container platform 3.11
    redhat openshift container platform 4.0
    fedoraproject fedora 30
    fedoraproject fedora 31
    canonical ubuntu linux 18.04
    canonical ubuntu linux 19.10
    opensuse leap 15.1
    haproxy haproxy 1.8.7
    haproxy haproxy 1.8.0
    haproxy haproxy 1.8.9
    haproxy haproxy 1.8.13
    haproxy haproxy 1.8.14
    haproxy haproxy 1.9.6
    haproxy haproxy 1.9.1
    haproxy haproxy 1.8.16
    haproxy haproxy 2.0.2
    haproxy haproxy 2.0.5
    haproxy haproxy 2.0.9