PT-2019-12239 · Haproxy+1 · Haproxy+1

Publicado 2019-05-08 · Atualizado 2021-07-21 · CVE-2019-11323

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HAProxy versions prior to 1.9.7

Description The issue arises from HAProxy mishandling a reload with rotated keys. This results in the use of uninitialized and very predictable HMAC keys, which is related to an error in include/types/ssl sock.h.

Recommendations For versions prior to 1.9.7, update to version 1.9.7 or later to resolve the issue.

Correção

Use of a Broken Cryptographic Algorithm

Use of Uninitialized Resource

Enumeração de Fraquezas

CWE-327

CWE-908

Identificadores relacionados

ALT-PU-2019-1781

CVE-2019-11323

Produtos afetados

Alt Linux

Haproxy

Referências · 8

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11323 · Nota de Segurança
• http://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=8ef706502aa2000531d36e4ac56dbdc7c30f718d · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11323 · Nota
• https://errata.altlinux.org/ALT-PU-2019-1781 · Aviso do Fabricante
• https://mail-archive.com/haproxy%40formilux.org/msg33410.html · Nota
• https://osv.dev/vulnerability/CVE-2019-11323 · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2019-11323 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11323 · Nota de Segurança