CVE-2020-11100 — Out-of-bounds Write in Haproxy

CWE-787 — Out-of-bounds WriteCWE-20 — Improper Input Validation9 documents8 sources
Severity
8.8HIGHNVD
EPSS
74.8%
top 1.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
HaproxyCanonical Ubuntu LinuxDebian Linux+3 more
Timeline
PublishedApr 2
Latest updateMay 24

Description

In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDhaproxy/haproxy1.8.0 — 2.1.4
▶Debianhaproxy/haproxy< 2.0.13-2+3
▶NVDopensuse/leap15.1

Also affects: Debian Linux 10.0, Fedora 30, 31, Ubuntu Linux 18.04, 19.10, Openshift Container Platform 3.11, 4.0

🔴Vulnerability Details

3
GHSA
GHSA-3xcv-57q9-hrj2: In hpack_dht_insert in hpack-tbl↗2022-05-24
▶
OSV
CVE-2020-11100: In hpack_dht_insert in hpack-tbl↗2020-04-02
▶
CVEList
CVE-2020-11100: In hpack_dht_insert in hpack-tbl↗2020-04-02
▶

📋Vendor Advisories

3
Ubuntu
HAProxy vulnerability↗2020-04-07
▶
Red Hat
haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes↗2020-04-02
▶
Debian
CVE-2020-11100: haproxy - In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes [fedora-all]↗2020-04-02
▶
Bugzilla
CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes↗2020-03-31
▶
CVE-2020-11100 — Out-of-bounds Write in Haproxy | cvebase