CVE-2020-11100
Fixed in a distro release EPSS 62%
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
Products: haproxy, debian_linux, redhat openshift_container_platform, fedoraproject fedora, canonical ubuntu_linux, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | haproxy | 2.0.14-r0 |
| Alpine 3.11 | haproxy | 2.0.14-r0 |
| Alpine 3.12 | haproxy | 2.1.4-r0 |
| Alpine 3.13 | haproxy | 2.1.4-r0 |
| Alpine 3.14 | haproxy | 2.1.4-r0 |
| Alpine 3.15 | haproxy | 2.1.4-r0 |
| Alpine 3.16 | haproxy | 2.1.4-r0 |
| Alpine 3.17 | haproxy | 2.1.4-r0 |
| Alpine 3.18 | haproxy | 2.1.4-r0 |
| Alpine 3.19 | haproxy | 2.1.4-r0 |
| Alpine 3.20 | haproxy | 2.1.4-r0 |
| Alpine 3.21 | haproxy | 2.1.4-r0 |
| Alpine 3.22 | haproxy | 2.1.4-r0 |
| Alpine 3.23 | haproxy | 2.1.4-r0 |
| Alpine 3.24 | haproxy | 2.1.4-r0 |
| Alpine 3.9 | haproxy | 1.8.25-r0 |
| Arch Linux | haproxy | 2.1.4-1 |
| Debian 10 | haproxy | 1.8.19-1+deb10u2 |
| Debian 12 | haproxy | 2.0.13-2 |
| Debian 13 | haproxy | 2.0.13-2 |
| Debian 14 | haproxy | 2.0.13-2 |
| Red Hat Enterprise Linux 8 | haproxy | 0:1.8.15-6.el8_1.1 |
| Red Hat Enterprise Linux 8 | haproxy-debuginfo | 0:1.8.15-6.el8_1.1 |
| Red Hat Enterprise Linux 8 | haproxy-debugsource | 0:1.8.15-6.el8_1.1 |
| Red Hat openshift 3.11 | haproxy | 0:1.8.23-3.el7 |
| Red Hat openshift 3.11 | haproxy-debuginfo | 0:1.8.23-3.el7 |
| Red Hat openshift 3.11 | haproxy18 | 0:1.8.23-3.el7 |
| Red Hat openshift 4.4 | haproxy | 0:2.0.13-3.el8 |
| Red Hat openshift 4.4 | haproxy | 0:2.0.13-3.el7 |
| Red Hat openshift 4.4 | haproxy-debuginfo | 0:2.0.13-3.el7 |
| Red Hat openshift 4.4 | haproxy-debugsource | 0:2.0.13-3.el8 |
| Red Hat openshift 4.4 | haproxy20 | 0:2.0.13-3.el8 |
| Red Hat openshift 4.4 | haproxy20 | 0:2.0.13-3.el7 |
| Red Hat openshift 4.4 | haproxy20-debuginfo | 0:2.0.13-3.el8 |
| Red Hat rhel e4s 8.0 | haproxy | 0:1.8.15-5.el8_0.1 |
| Red Hat rhel e4s 8.0 | haproxy-debuginfo | 0:1.8.15-5.el8_0.1 |
| Red Hat rhel e4s 8.0 | haproxy-debugsource | 0:1.8.15-5.el8_0.1 |
| Red Hat rhel software collections 3 | rh-haproxy18-haproxy | 0:1.8.17-1.el7.1 |
| Red Hat rhel software collections 3 | rh-haproxy18-haproxy-debuginfo | 0:1.8.17-1.el7.1 |
| Red Hat rhel software collections 3 | rh-haproxy18-haproxy-syspaths | 0:1.8.17-1.el7.1 |
| SUSE Linux Enterprise High Availability Extension 15 | haproxy | 2.0.10+git0.ac198b92-3.19.1 |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | haproxy | 2.0.10+git0.ac198b92-8.12.1 |
| Ubuntu 18.04 LTS | haproxy | 1.8.8-1ubuntu0.10 |
| openSUSE Leap 15.1 | haproxy | 2.0.10+git0.ac198b92-lp151.2.9.1 |
| openSUSE Tumbleweed | haproxy | 2.4.4+git0.acb1d0bea-1.2 |