The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-1725 advisory.

  - A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header     missing the chunked value were not being correctly rejected. The impact was limited but if combined with     the http-reuse always setting, it could be used to help construct an HTTP request smuggling attack     against a vulnerable component employing a lenient parser that would ignore the content-length header as     soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).
    (CVE-2019-18277)

  - The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return     (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary     Encapsulation Attacks. (CVE-2019-19330)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1287 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2265 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:1725 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the haproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The HTTP/2 implementation in HAProxy before 2.0.10     mishandles headers, as demonstrated by carriage return     (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the     zero character (NUL, ASCII 0x0), aka Intermediary     Encapsulation Attacks.(CVE-2019-19330)

  - A flaw was found in HAProxy before 2.0.6. In legacy     mode, messages featuring a transfer-encoding header     missing the 'chunked' value were not being correctly     rejected. The impact was limited but if combined with     the 'http-reuse always' setting, it could be used to     help construct an HTTP request smuggling attack against     a vulnerable component employing a lenient parser that     would ignore the content-length header as soon as it     saw a transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2019-18277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The HTTP/2 implementation in HAProxy before 2.0.10     mishandles headers, as demonstrated by carriage return     (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the     zero character (NUL, ASCII 0x0), aka Intermediary     Encapsulation Attacks.(CVE-2019-19330)

  - A flaw was found in HAProxy before 2.0.6. In legacy     mode, messages featuring a transfer-encoding header     missing the 'chunked' value were not being correctly     rejected. The impact was limited but if combined with     the 'http-reuse always' setting, it could be used to     help construct an HTTP request smuggling attack against     a vulnerable component employing a lenient parser that     would ignore the content-length header as soon as it     saw a transfer-encoding one (even if not entirely valid     according to the specification).(CVE-2019-18277)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1936 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1725 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202004-01 (HAProxy: Remote execution of arbitrary code)

    It was discovered that HAProxy incorrectly handled certain HTTP/2       headers.
  Impact :

    A remote attacker could send a specially crafted HTTP/2 header, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update of the haproxy package has been released.

Tim Dusterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to execute arbitrary code through CRLF injection.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tim Dusterhus discovered that haproxy, a TCP/HTTP reverse proxy, did not properly sanitize HTTP headers when converting from HTTP/2 to HTTP/1. This would allow a remote user to perform CRLF injections.

ID	Name	Product	Family	Severity
180906	Oracle Linux 8 : haproxy (ELSA-2020-1725)	Nessus	Oracle Linux Local Security Checks	critical
170348	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:1287)	Nessus	Red Hat Local Security Checks	critical
170315	RHEL 7 : rh-haproxy18-haproxy (RHSA-2020:2265)	Nessus	Red Hat Local Security Checks	critical
145810	CentOS 8 : haproxy (CESA-2020:1725)	Nessus	CentOS Local Security Checks	critical
140007	EulerOS Virtualization for ARM 64 3.0.6.0 : haproxy (EulerOS-SA-2020-1904)	Nessus	Huawei Local Security Checks	critical
139135	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2020-1805)	Nessus	Huawei Local Security Checks	critical
136319	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 haproxy (RHSA-2020:1936)	Nessus	Red Hat Local Security Checks	critical
136052	RHEL 8 : haproxy (RHSA-2020:1725)	Nessus	Red Hat Local Security Checks	critical
135112	GLSA-202004-01 : HAProxy: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
133064	Photon OS 3.0: Haproxy PHSA-2020-3.0-0047	Nessus	PhotonOS Local Security Checks	critical
132965	Photon OS 1.0: Haproxy PHSA-2019-1.0-0263	Nessus	PhotonOS Local Security Checks	critical
131722	Ubuntu 18.04 LTS : HAProxy vulnerability (USN-4212-1)	Nessus	Ubuntu Local Security Checks	critical
131438	Debian DSA-4577-1 : haproxy - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-19330

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical