CVE-2020-11100

HAProxy could be made to execute arbitrary code if it received a specially crafted HTTP/2 request ...

Felix Wilhelm of Google Project Zero discovered that HAProxy, a TCP/HTTP reverse proxy, did not properly handle HTTP/2 headers This would allow an attacker to write arbitrary bytes around a certain location on the heap, resulting in denial-of-service or potential arbitrary code execution For the stable distribution (buster), this problem has been ...

Synopsis Critical: haproxy security update Type/Severity Security Advisory: Critical Topic An update for haproxy is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability ...

Synopsis Critical: haproxy security update Type/Severity Security Advisory: Critical Topic An update for haproxy is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...

Synopsis Critical: rh-haproxy18-haproxy security update Type/Severity Security Advisory: Critical Topic An update for rh-haproxy18-haproxy is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring ...

Synopsis Critical: OpenShift Container Platform 311 security update Type/Severity Security Advisory: Critical Topic Red Hat OpenShift Container Platform release 311200 is now available withupdates to packages and images that fix several bugsRed Hat Product Security has rated this update as having a secu ...

In hpack_dht_insert in hpack-tblc in the HPACK decoder in HAProxy 18 through 2x before 214, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution (CVE-2020-11100) ...

An out-of-bounds memory write has been found in HAProxy before 214, in the HPACK table management code ...