Описание
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 1.8.8-1ubuntu0.9 |
| devel | not-affected | |
| disco | released | 1.8.19-1ubuntu1.3 |
| eoan | released | 2.0.5-1ubuntu0.3 |
| esm-infra-legacy/trusty | DNE | |
| esm-infra-legacy/xenial | not-affected | |
| esm-infra/bionic | released | 1.8.8-1ubuntu0.9 |
| esm-infra/xenial | not-affected | |
| precise/esm | DNE | |
| trusty | ignored | end of standard support |
Показывать по
Ссылки на источники
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, ...
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
Уязвимость серверного программного обеспечения HAProxy, связанная с неправильным выполнением очистки HTTP-заголовков при преобразовании из HTTP/2 в HTTP/1, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
EPSS
7.5 High
CVSS2
9.8 Critical
CVSS3