Описание
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
A flaw was found in the way HAProxy processed certain HTTP/2 request packets. This flaw allows an attacker to send crafted HTTP/2 request packets, which cause memory corruption, leading to a crash or potential remote arbitrary code execution with the permissions of the user running HAProxy.
Отчет
HAProxy packages shipped with Red Hat Enterprise Linux 6 and 7 do not contain support for HTTP/2; therefore, they are not affected by this flaw. OpenShift Container Platform versions through 4.3 contain the vulnerable code; exploitation requires setting ROUTER_USE_HTTP2 in the OpenShift Ingress Operator, which is not currently possible. The impact of this vulnerability is therefore reduced in OCP 4.x, prior to version 4.4, to low. OpenShift Container Platform 3.11 added a configuration option to ose-haproxy-router that made enabling HTTP/2 support easy. However, it is not enabled by default on that version.
Меры по смягчению последствий
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | haproxy | Not affected | ||
| Red Hat Enterprise Linux 7 | haproxy | Not affected | ||
| Red Hat Enterprise Linux 8 | haproxy | Fixed | RHSA-2020:1288 | 02.04.2020 |
| Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions | haproxy | Fixed | RHSA-2020:1289 | 02.04.2020 |
| Red Hat OpenShift Container Platform 3.11 | haproxy | Fixed | RHSA-2020:1287 | 07.04.2020 |
| Red Hat OpenShift Container Platform 4.4 | haproxy | Fixed | RHSA-2020:1936 | 04.05.2020 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-haproxy18-haproxy | Fixed | RHSA-2020:1290 | 02.04.2020 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | rh-haproxy18-haproxy | Fixed | RHSA-2020:1290 | 02.04.2020 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-haproxy18-haproxy | Fixed | RHSA-2020:1290 | 02.04.2020 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-haproxy18-haproxy | Fixed | RHSA-2020:1290 | 02.04.2020 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 ...
EPSS
8.8 High
CVSS3