A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-1725 advisory.

  - A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header     missing the chunked value were not being correctly rejected. The impact was limited but if combined with     the http-reuse always setting, it could be used to help construct an HTTP request smuggling attack     against a vulnerable component employing a lenient parser that would ignore the content-length header as     soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).
    (CVE-2019-18277)

  - The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return     (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary     Encapsulation Attacks. (CVE-2019-19330)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1287 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2265 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3034 advisory.

  - An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due     to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes     corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything     that was left on the stack, or even past the end of the 8193-byte buffer, depending on the value of     accepted_payload_size. (CVE-2018-20102)

  - An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted     packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of     valid pointers resulting in stack exhaustion. (CVE-2018-20103)

  - A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header     missing the chunked value were not being correctly rejected. The impact was limited but if combined with     the http-reuse always setting, it could be used to help construct an HTTP request smuggling attack     against a vulnerable component employing a lenient parser that would ignore the content-length header as     soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).
    (CVE-2019-18277)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in HAProxy before 2.0.6. In legacy     mode, messages featuring a transfer-encoding header     missing the 'chunked' value were not being correctly     rejected. The impact was limited but if combined with     the 'http-reuse always' setting, it could be used to     help construct an HTTP request smuggling attack against     a vulnerable component employing a lenient parser that     would ignore the content-length header as soon as it     saw a transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2019-18277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:1725 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the haproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The HTTP/2 implementation in HAProxy before 2.0.10     mishandles headers, as demonstrated by carriage return     (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the     zero character (NUL, ASCII 0x0), aka Intermediary     Encapsulation Attacks.(CVE-2019-19330)

  - A flaw was found in HAProxy before 2.0.6. In legacy     mode, messages featuring a transfer-encoding header     missing the 'chunked' value were not being correctly     rejected. The impact was limited but if combined with     the 'http-reuse always' setting, it could be used to     help construct an HTTP request smuggling attack against     a vulnerable component employing a lenient parser that     would ignore the content-length header as soon as it     saw a transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2019-18277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The HTTP/2 implementation in HAProxy before 2.0.10     mishandles headers, as demonstrated by carriage return     (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the     zero character (NUL, ASCII 0x0), aka Intermediary     Encapsulation Attacks.(CVE-2019-19330)

  - A flaw was found in HAProxy before 2.0.6. In legacy     mode, messages featuring a transfer-encoding header     missing the 'chunked' value were not being correctly     rejected. The impact was limited but if combined with     the 'http-reuse always' setting, it could be used to     help construct an HTTP request smuggling attack against     a vulnerable component employing a lenient parser that     would ignore the content-length header as soon as it     saw a transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2019-18277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the haproxy package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in HAProxy before 2.0.6. In legacy     mode, messages featuring a transfer-encoding header     missing the 'chunked' value were not being correctly     rejected. The impact was limited but if combined with     the 'http-reuse always' setting, it could be used to     help construct an HTTP request smuggling attack against     a vulnerable component employing a lenient parser that     would ignore the content-length header as soon as it     saw a transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2019-18277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1936 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the haproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in HAProxy before 2.0.6. In legacy     mode, messages featuring a transfer-encoding header     missing the 'chunked' value were not being correctly     rejected. The impact was limited but if combined with     the 'http-reuse always' setting, it could be used to     help construct an HTTP request smuggling attack against     a vulnerable component employing a lenient parser that     would ignore the content-length header as soon as it     saw a transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2019-18277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1725 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the haproxy package has been released.

This update for haproxy to version 2.0.10 fixes the following issues :

HAProxy was updated to 2.0.10 &#9; 

Security issues fixed :

  - CVE-2019-18277: Fixed a potential HTTP smuggling in     messages with transfer-encoding header missing the     'chunked' (bsc#1154980).

  - Fixed an improper handling of headers which could have     led to injecting LFs in H2-to-H1 transfers creating new     attack space (bsc#1157712)

  - Fixed an issue where HEADER frames in idle streams are     not rejected and thus trying to decode them HAPrpxy     crashes (bsc#1157714).

Other issue addressed :

  - Macro change in the spec file (bsc#1082318)

More information regarding the release at:
http://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d46151555 1b95daae20954b3053ce87e&#9; 

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for haproxy to version 2.0.10 fixes the following issues :

HAProxy was updated to 2.0.10 &#9; 

Security issues fixed :

  - CVE-2019-18277: Fixed a potential HTTP smuggling in     messages with transfer-encoding header missing the     'chunked' (bsc#1154980).

  - Fixed an improper handling of headers which could have     led to injecting LFs in H2-to-H1 transfers creating new     attack space (bsc#1157712)

  - Fixed an issue where HEADER frames in idle streams are     not rejected and thus trying to decode them HAPrpxy     crashes (bsc#1157714).

Other issue addressed :

  - Macro change in the spec file (bsc#1082318)

More information regarding the release at:
http://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d46151555 1b95daae20954b3053ce87e

This update was imported from the SUSE:SLE-15:Update update project.

It was discovered that HAproxy incorrectly handled certain HTTP requests. An attacker could possibly use this issue to a privilege escalation (Request Smuggling).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180906	Oracle Linux 8 : haproxy (ELSA-2020-1725)	Nessus	Oracle Linux Local Security Checks	critical
170348	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:1287)	Nessus	Red Hat Local Security Checks	critical
170315	RHEL 7 : rh-haproxy18-haproxy (RHSA-2020:2265)	Nessus	Red Hat Local Security Checks	critical
161700	Debian DLA-3034-1 : haproxy - LTS security update	Nessus	Debian Local Security Checks	high
149110	EulerOS 2.0 SP3 : haproxy (EulerOS-SA-2021-1797)	Nessus	Huawei Local Security Checks	high
145810	CentOS 8 : haproxy (CESA-2020:1725)	Nessus	CentOS Local Security Checks	critical
140007	EulerOS Virtualization for ARM 64 3.0.6.0 : haproxy (EulerOS-SA-2020-1904)	Nessus	Huawei Local Security Checks	critical
139135	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2020-1805)	Nessus	Huawei Local Security Checks	critical
137976	EulerOS Virtualization 3.0.6.0 : haproxy (EulerOS-SA-2020-1757)	Nessus	Huawei Local Security Checks	high
136319	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 haproxy (RHSA-2020:1936)	Nessus	Red Hat Local Security Checks	critical
136226	EulerOS Virtualization for ARM 64 3.0.2.0 : haproxy (EulerOS-SA-2020-1523)	Nessus	Huawei Local Security Checks	high
136052	RHEL 8 : haproxy (RHSA-2020:1725)	Nessus	Red Hat Local Security Checks	critical
133906	EulerOS 2.0 SP5 : haproxy (EulerOS-SA-2020-1105)	Nessus	Huawei Local Security Checks	high
132589	Photon OS 3.0: Haproxy PHSA-2019-3.0-0038	Nessus	PhotonOS Local Security Checks	high
132542	Photon OS 2.0: Haproxy PHSA-2019-2.0-0187	Nessus	PhotonOS Local Security Checks	high
131721	openSUSE Security Update : haproxy (openSUSE-2019-2645)	Nessus	SuSE Local Security Checks	high
131688	openSUSE Security Update : haproxy (openSUSE-2019-2626)	Nessus	SuSE Local Security Checks	high
130587	Ubuntu 16.04 LTS / 18.04 LTS : HAproxy vulnerability (USN-4174-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2019-18277

high

Tenable Plugins

critical

critical

critical

high

high

critical

critical

critical

high

critical

high

critical

high

high

high

high

high

high