In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.

The version of haproxy2 installed on the remote host is prior to 2.1.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2HAPROXY2-2023-006 advisory.

  - In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote     attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request,     possibly causing remote code execution. (CVE-2020-11100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1287 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1290 advisory.

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1288 advisory.

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202012-22 (HAProxy: Arbitrary code execution)

    It was discovered that HAProxy incorrectly handled certain HTTP/2       headers.
  Impact :

    A remote attacker, by sending a specially crafted HTTP/2 request, could       possibly execute arbitrary code with the privileges of the process, or       cause a Denial of Service condition.
  Workaround :

    Disable HTTP/2 support.

According to the version of the haproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In hpack_dht_insert in hpack-tbl.c in the HPACK decoder     in HAProxy 1.8 through 2.x before 2.1.4, a remote     attacker can write arbitrary bytes around a certain     location on the heap via a crafted HTTP/2 request,     possibly causing remote code execution.(CVE-2020-11100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In hpack_dht_insert in hpack-tbl.c in the HPACK decoder     in HAProxy 1.8 through 2.x before 2.1.4, a remote     attacker can write arbitrary bytes around a certain     location on the heap via a crafted HTTP/2 request,     possibly causing remote code execution.(CVE-2020-11100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1936 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the haproxy package has been released.

Security fix for CVE-2020-11100)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Felix Wilhelm of Google Project Zero discovered that HAProxy, a TCP/HTTP reverse proxy, did not properly handle HTTP/2 headers. This would allow an attacker to write arbitrary bytes around a certain location on the heap, resulting in denial-of-service or potential arbitrary code execution.

Felix Wilhelm discovered that HAProxy incorrectly handled certain HTTP/2 requests. An attacker could possibly use this to execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for haproxy fixes the following issues :

  - CVE-2020-11100: Fixed an H2/HPAC vulnerability ch might     have allowed arbitrary writes into a 32-bit relative     address space (bsc#1168023).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

From Red Hat Security Advisory 2020:1288 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1288 advisory.

  - haproxy: malformed HTTP/2 requests can lead to out-of-     bounds writes (CVE-2020-11100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The HAproxy Project reports :

The main driver for this release is that it contains a fix for a serious vulnerability that was responsibly reported last week by Felix Wilhelm from Google Project Zero, affecting the HPACK decoder used for HTTP/2. CVE-2020-11100 was assigned to this issue.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1289 advisory.

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1288 advisory.

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
181985	Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-006)	Nessus	Amazon Linux Local Security Checks	high
170348	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:1287)	Nessus	Red Hat Local Security Checks	critical
170290	RHEL 7 : rh-haproxy18-haproxy (RHSA-2020:1290)	Nessus	Red Hat Local Security Checks	high
146014	CentOS 8 : haproxy (CESA-2020:1288)	Nessus	CentOS Local Security Checks	high
144610	GLSA-202012-22 : HAProxy: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
137816	EulerOS Virtualization for ARM 64 3.0.6.0 : haproxy (EulerOS-SA-2020-1709)	Nessus	Huawei Local Security Checks	high
136858	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2020-1580)	Nessus	Huawei Local Security Checks	high
136319	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 haproxy (RHSA-2020:1936)	Nessus	Red Hat Local Security Checks	critical
136032	Photon OS 1.0: Haproxy PHSA-2020-1.0-0289	Nessus	PhotonOS Local Security Checks	high
135781	Photon OS 3.0: Haproxy PHSA-2020-3.0-0078	Nessus	PhotonOS Local Security Checks	high
135418	Fedora 30 : haproxy (2020-16cd111544)	Nessus	Fedora Local Security Checks	high
135416	Debian DSA-4649-1 : haproxy - security update	Nessus	Debian Local Security Checks	high
135282	Ubuntu 18.04 LTS : HAProxy vulnerability (USN-4321-1)	Nessus	Ubuntu Local Security Checks	high
135220	openSUSE Security Update : haproxy (openSUSE-2020-444)	Nessus	SuSE Local Security Checks	high
135217	Oracle Linux 8 : haproxy (ELSA-2020-1288)	Nessus	Oracle Linux Local Security Checks	high
135192	FreeBSD : HAproxy -- serious vulnerability affecting the HPACK decoder used for HTTP/2 (7f829d44-7509-11ea-b47c-589cfc0f81b0)	Nessus	FreeBSD Local Security Checks	high
135184	RHEL 8 : haproxy (RHSA-2020:1289)	Nessus	Red Hat Local Security Checks	high
135183	RHEL 8 : haproxy (RHSA-2020:1288)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-11100

high

Tenable Plugins

high

critical

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high