PT-2018-3533 · Haproxy+3 · Haproxy+3
Tim Düsterhus
·
Publicado
2018-12-31
·
Atualizado
2024-06-15
·
CVE-2018-20615
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
HAProxy versions 1.8.x through 1.9.0
Description:
An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder, which can result in a crash. The issue arises from the processing of the PRIORITY flag in a HEADERS frame, where 5 extra bytes are required but not properly checked, potentially leading to a denial of service. This can be exploited by a remote attacker using a specially crafted packet.
Recommendations:
For HAProxy versions 1.8.x through 1.9.0, consider disabling the HTTP/2 protocol decoder until a patch is available to prevent potential crashes.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Haproxy
Suse
Ubuntu