PT-2018-3535 · Haproxy+3 · Haproxy+3

Nathan Davison · Published 2018-12-12 · Updated 2022-06-02 · CVE-2018-20102

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: HAProxy versions through 1.8.14

Description: An out-of-bounds read issue in the dns validate dns response function in dns.c allows remote attackers to potentially read unauthorized data from the stack or past the end of the buffer, depending on the accepted payload size value. This could lead to unauthorized access to protected information.

Recommendations: For HAProxy versions through 1.8.14, update to a version that includes a fix for the out-of-bounds read issue in the dns validate dns response function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-1002

BDU:2020-03309

CVE-2018-20102

DLA-3034-1

OPENSUSE-SU-2019:0044-1

OPENSUSE-SU-2019_0044-1

RHSA-2019:0547

RHSA-2019:1436

SUSE-SU-2019:0061-1

SUSE-SU-2019_0061-1

USN-3858-1

Affected Products

Alt Linux

Haproxy

Suse

Ubuntu

References · 31

• https://security-tracker.debian.org/tracker/CVE-2018-20102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20102 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:0061-1 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0326 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0327 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-20102 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20102 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20102 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20103 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20102 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://usn.ubuntu.com/3858-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3858-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1436 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3034-1 · Vendor Advisory