CVE-2020-11100 (NVD)

2020-04-02

In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.

Products Ubuntu_linux, Debian_linux, Fedora, Haproxy, Leap, Openshift_container_platform
Type Out-of-bounds Write (CWE-787)
First patch - None (likely due to unavailable code)
Links • https://www.haproxy.org/download/2.1/src/CHANGELOG
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNW5RZLIX7LOXRLV7WMHX22CI43XSXKW/
• http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html
• https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88
• https://bugzilla.suse.com/show_bug.cgi?id=1168023