Critical Heap Vulnerability in HAProxy: CVE-2020-11100
Summary
ALPINE-CVE-2020-11100: In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly ca... Affects haproxy versions < 2.0.14-r0. Fixed in 2.0.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely-used open-source software that provides high availability, load balancing, and proxying for TCP and HTTP-based applications. It is known for its performance and reliability, making it a popular choice for managing web traffic. However, certain versions of HAProxy are vulnerable to a critical issue that can lead to remote code execution, affecting the security of applications relying on it.
Vulnerability Detail
The vulnerability, identified as CVE-2020-11100, exists in the HPACK decoder of HAProxy versions 1.8 through 2.x prior to 2.1.4. A remote attacker can exploit this vulnerability by sending a crafted HTTP/2 request, which allows them to write arbitrary bytes around a specific location on the heap. This could potentially lead to remote code execution, compromising the integrity and confidentiality of the affected system.
How To Fix
Minimum fixed version
2.0.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling HTTP/2 support in HAProxy as a temporary workaround. This can be done by modifying the HAProxy configuration file to remove or comment out the HTTP/2 settings.
Conclusion
CVE-2020-11100 represents a significant security risk for users of HAProxy, allowing for potential remote code execution. It is crucial to update to the latest patched versions to safeguard against this vulnerability. Users should also consider using tools like Vulert to monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for haproxy →
FAQ
CVE-2020-11100 is a critical vulnerability in HAProxy that allows remote code execution through crafted HTTP/2 requests.
HAProxy versions 1.8 through 2.x prior to 2.1.4 are vulnerable to this issue.
You can use Vulert's playground to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2020-11100 is 8.8, indicating a high severity level.
As a temporary measure, you can disable HTTP/2 support in your HAProxy configuration to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
