7.5
CVSSv3

CVE-2018-20103

Published: 12/12/2018 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

An issue exists in dns.c in HAProxy up to and including 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

haproxy haproxy

canonical ubuntu linux 16.04

canonical ubuntu linux 18.04

canonical ubuntu linux 18.10

redhat openshift container platform 3.11

Vendor Advisories

Synopsis Moderate: rh-haproxy18-haproxy security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for rh-haproxy18-haproxy is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Moderate A Com ...
Several security issues were fixed in HAProxy ...
Debian Bug report logs - #916308 haproxy: CVE-2018-20102 Package: src:haproxy; Maintainer for src:haproxy is Debian HAProxy Maintainers <haproxy@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 12 Dec 2018 21:00:02 UTC Severity: grave Tags: patch, security, upstream Found in vers ...
Debian Bug report logs - #916307 haproxy: CVE-2018-20103 Package: src:haproxy; Maintainer for src:haproxy is Debian HAProxy Maintainers <haproxy@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 12 Dec 2018 20:51:08 UTC Severity: important Tags: patch, security, upstream Found in ...
An issue was discovered in dnsc in HAProxy through 1814 In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion ...
A stack-exhaustion issue has been found in HAProxy before 1815, in the dns_read_name() function in dnsc, where an infinite recursion can be triggered via a crafted DNS packet ...