PT-2018-3534 · Haproxy+3 · Haproxy+3

Published 2018-12-12 · Updated 2024-06-15 · CVE-2018-20103

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: HAProxy versions prior to 1.8.15

Description: The issue is related to a crafted packet that can trigger infinite recursion or create a long chain of valid pointers, resulting in stack exhaustion. This can be exploited by a remote attacker to cause a denial of service.

Recommendations: For HAProxy versions prior to 1.8.15, update to version 1.8.15 or later to resolve the issue. At the moment, there is no other information about additional mitigation measures for this vulnerability.

Fix

Infinite Loop

Resource Exhaustion

Weakness Enumeration

CWE-835

CWE-400

Related Identifiers

ALT-PU-2019-1002

BDU:2020-03308

CVE-2018-20103

DLA-3034-1

OPENSUSE-SU-2019:0044-1

OPENSUSE-SU-2019_0044-1

OPENSUSE-SU-2024:10839-1

RHSA-2019:1436

SUSE-SU-2019:0061-1

USN-3858-1

Affected Products

Alt Linux

Haproxy

Suse

Ubuntu

References · 39

• https://cve.org/CVERecord?id=CVE-2018-20103 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:0061-1 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0326 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10839-1 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0327 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20103 · Security Note
• https://ubuntu.com/security/CVE-2018-20103 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-20103 · Vendor Advisory
• https://usn.ubuntu.com/3858-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3858-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1436 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03308 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20103 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20103 · Vendor Advisory