CVE-2020-11100
published 2020-04-02CVE-2020-11100: In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain…
PriorityP273high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
60.73%
99.0th percentile
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | haproxy | < haproxy 2.0.13-2 (bookworm) | haproxy 2.0.13-2 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| haproxy | haproxy | >= 0 < 2.0.13-2 | 2.0.13-2 |
| haproxy | haproxy | >= 0 < 2.0.13-2 | 2.0.13-2 |
| haproxy | haproxy | >= 0 < 2.0.13-2 | 2.0.13-2 |
| haproxy | haproxy | >= 0 < 2.0.13-2 | 2.0.13-2 |
| haproxy | haproxy | >= 1.8.0 < 2.1.4 | 2.1.4 |
| opensuse | leap | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring for crafted HTTP/2 requests targeting HAProxy's HPACK decoder; specifically, anomalous HPACK dynamic header table insertions (hpack_dht_insert) that may indicate out-of-bounds heap write attempts. ↗
- →Check HAProxy configuration files for lines containing 'h2' to determine if HTTP/2 is enabled and the system is exposed to this vulnerability. ↗
- →Monitor for HAProxy process crashes or unexpected memory corruption events, which may indicate active exploitation of this heap write vulnerability via HTTP/2. ↗
- →On Red Hat Enterprise Linux 8, verify SELinux confinement of the haproxy process as a compensating control that may limit the impact of successful exploitation. ↗
- ·HAProxy versions 1.8 through 2.x before 2.1.4 are vulnerable only when HTTP/2 support is enabled. HAProxy packages on RHEL 6 and 7 do not include HTTP/2 support and are not affected. ↗
- ·In OpenShift Container Platform 4.x (prior to 4.4), exploitation requires explicitly setting ROUTER_USE_HTTP2 in the OpenShift Ingress Operator, which is not possible by default, reducing the effective risk. ↗
- ·HTTP/2 is not enabled by default in OpenShift Container Platform 3.11; the configuration option to enable it exists but must be explicitly activated. ↗
- ·Disabling HTTP/2 protocol support entirely in HAProxy configuration is an effective mitigation for this vulnerability. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3xcv-57q9-hrj2: In hpack_dht_insert in hpack-tbl
ghsa_unreviewed·2022-05-24
CVE-2020-11100 [MEDIUM] CWE-787 GHSA-3xcv-57q9-hrj2: In hpack_dht_insert in hpack-tbl
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
OSV
CVE-2020-11100: In hpack_dht_insert in hpack-tbl
osv·2020-04-02·CVSS 8.8
CVE-2020-11100 [HIGH] CVE-2020-11100: In hpack_dht_insert in hpack-tbl
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
Ubuntu
HAProxy vulnerability
vendor_ubuntu·2020-04-07
CVE-2020-11100 HAProxy vulnerability
Title: HAProxy vulnerability
Summary: HAProxy could be made to execute arbitrary code if it received a specially crafted HTTP/2 request.
Felix Wilhelm discovered that HAProxy incorrectly handled certain HTTP/2 requests.
An attacker could possibly use this to execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes
vendor_redhat·2020-04-02·CVSS 8.8
CVE-2020-11100 [HIGH] CWE-20 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes
haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
A flaw was found in the way HAProxy processed certain HTTP/2 request packets. This flaw allows an attacker to send crafted HTTP/2 request packets, which cause memory corruption, leading to a crash or potential remote arbitrary code execution with the permissions of the user running HAProxy.
Statement: HAProxy packages shipped with Red Hat Enterprise Linux 6 and 7 do not contain support for HTTP/2; therefore, they are not affected by this flaw.
OpenShift Container Platform ver
Debian
CVE-2020-11100: haproxy - In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2...
vendor_debian·2020·CVSS 8.8
CVE-2020-11100 [HIGH] CVE-2020-11100: haproxy - In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2...
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
Scope: local
bookworm: resolved (fixed in 2.0.13-2)
bullseye: resolved (fixed in 2.0.13-2)
forky: resolved (fixed in 2.0.13-2)
sid: resolved (fixed in 2.0.13-2)
trixie: resolved (fixed in 2.0.13-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes [fedora-all]
bugzilla·2020-04-02·CVSS 8.8
CVE-2020-11100 [HIGH] CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes [fedora-all]
CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes
bugzilla·2020-03-31·CVSS 8.8
CVE-2020-11100 [HIGH] CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes
CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes
A flaw was found in the way haproxy processed certain HTTP/2 request packets. An attacker could send crafted HTTP/2 request packets which cause memory corruption, leading to a crash or potential remote arbitrary code execution with the permissions of the user running haproxy.
Discussion:
Created attachment 1675022
Description + proposed patch
---
This was assigned CVE-2020-11100.
Any change the product bugs are coming soon?
---
Statement:
HAProxy packages shipped with Red Hat Enterprise Linux 6 and 7 do not contain support for HTTP/2; therefore, they are not affected by this flaw.
OpenShift Container Platform versions through 4.3 contain the vulnerable code; exploitation requires setting ROUTER_USE
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.htmlhttp://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.htmlhttp://www.haproxy.orghttps://bugzilla.redhat.com/show_bug.cgi?id=1819111https://bugzilla.suse.com/show_bug.cgi?id=1168023https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88https://lists.debian.org/debian-security-announce/2020/msg00052.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/264C7UL3X7L7QE74ZJ557IOUFS3J4QQC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNW5RZLIX7LOXRLV7WMHX22CI43XSXKW/https://security.gentoo.org/glsa/202012-22https://usn.ubuntu.com/4321-1/https://www.debian.org/security/2020/dsa-4649https://www.haproxy.org/download/2.1/src/CHANGELOGhttps://www.mail-archive.com/haproxy%40formilux.org/msg36876.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.htmlhttp://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.htmlhttp://www.haproxy.orghttps://bugzilla.redhat.com/show_bug.cgi?id=1819111https://bugzilla.suse.com/show_bug.cgi?id=1168023https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88https://lists.debian.org/debian-security-announce/2020/msg00052.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/264C7UL3X7L7QE74ZJ557IOUFS3J4QQC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNW5RZLIX7LOXRLV7WMHX22CI43XSXKW/https://security.gentoo.org/glsa/202012-22https://usn.ubuntu.com/4321-1/https://www.debian.org/security/2020/dsa-4649https://www.haproxy.org/download/2.1/src/CHANGELOGhttps://www.mail-archive.com/haproxy%40formilux.org/msg36876.html
2020-04-02
Published