CVE-2018-14645

Опубликовано: 21 сент. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.

Ссылки

https://access.redhat.com/errata/RHBA-2019:0028
https://access.redhat.com/errata/RHSA-2018:2882
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14645
Issue Tracking
Mitigation
Third Party Advisory
https://usn.ubuntu.com/3780-1/
Third Party Advisory
https://www.mail-archive.com/haproxy%40formilux.org/msg31253.html
https://access.redhat.com/errata/RHBA-2019:0028
https://access.redhat.com/errata/RHSA-2018:2882
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14645
Issue Tracking
Mitigation
Third Party Advisory
https://usn.ubuntu.com/3780-1/
Third Party Advisory
https://www.mail-archive.com/haproxy%40formilux.org/msg31253.html

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*

Версия до 1.8.14 (включая)

Конфигурация 2

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:redhat:openshift:3.10:*:*:*:enterprise:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.00225

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2018-14645

CVSS3: 7.5

ubuntu

больше 7 лет назад

A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.

CVE-2018-14645

CVSS3: 7.5

redhat

больше 7 лет назад

A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.

CVE-2018-14645

CVSS3: 7.5

debian

больше 7 лет назад

A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, ...

GHSA-gr9c-vx25-2fh5

CVSS3: 7.5

github

больше 3 лет назад

A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.

BDU:2021-01442

CVSS3: 7.5

fstec

больше 7 лет назад

Уязвимость HPACK декодера серверного программного обеспечения HAProxy, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 45%

0.00225

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-125