CVE-2020-11100
Summary
| CVE | CVE-2020-11100 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-04-02 15:15:00 UTC |
|---|
| Updated | 2023-11-07 03:14:00 UTC |
|---|
| Description | In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| HAProxy中文网站 |
MISC |
www.haproxy.org |
Vendor Advisory |
| [SECURITY] Fedora 30 Update: haproxy-1.8.25-1.fc30 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] [DSA 4649-1] haproxy security update |
CONFIRM |
lists.debian.org |
Mailing List, Third Party Advisory |
| USN-4321-1: HAProxy vulnerability | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
|
| www.haproxy.org/download/2.1/src/CHANGELOG |
CONFIRM |
www.haproxy.org |
Release Notes, Vendor Advisory |
| [ANNOUNCE] haproxy-2.1.4 |
CONFIRM |
www.mail-archive.com |
Mailing List, Third Party Advisory |
| [ANNOUNCE] haproxy-2.1.4 |
|
www.mail-archive.com |
|
| [SECURITY] Fedora 30 Update: haproxy-1.8.25-1.fc30 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| HAProxy: Arbitrary code execution (GLSA 202012-22) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| [SECURITY] Fedora 31 Update: haproxy-2.0.14-1.fc31 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Repositories - haproxy.git/commit |
|
git.haproxy.org |
|
| [security-announce] openSUSE-SU-2020:0444-1: important: Security update |
SUSE |
lists.opensuse.org |
|
| Debian -- Security Information -- DSA-4649-1 haproxy |
DEBIAN |
www.debian.org |
|
| 1819111 – (CVE-2020-11100) CVE-2020-11100 haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes |
CONFIRM |
bugzilla.redhat.com |
Issue Tracking, Third Party Advisory |
| Bug 1168023 – VUL-0: CVE-2020-11100: haproxy: H2/HPACK vulnerability |
CONFIRM |
bugzilla.suse.com |
Issue Tracking, Third Party Advisory |
| [SECURITY] Fedora 31 Update: haproxy-2.0.14-1.fc31 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Repositories - haproxy.git/commit |
CONFIRM |
git.haproxy.org |
Patch, Vendor Advisory |
| haproxy hpack-tbl.c Out-Of-Bounds Write ≈ Packet Storm |
MISC |
packetstormsecurity.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 356213 Amazon Linux Security Advisory for haproxy2 : ALASHAPROXY2-2023-006
- 356474 Amazon Linux Security Advisory for haproxy2 : ALAS2HAPROXY2-2023-006
- 376951 Alibaba Cloud Linux Security Update for haproxy (ALINUX3-SA-2022:0043)
- 500240 Alpine Linux Security Update for haproxy
- 503989 Alpine Linux Security Update for haproxy
- 770024 Red Hat OpenShift Container Platform 4.4.3 Security Update (RHSA-2020:1936)
