SB2020050432 - Red Hat update for OpenShift Container Platform 4.4.3 haproxy
Published: May 4, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2019-18277)
The vulnerability allows a remote attacker to perform HTTP request smuggling attack.
The vulnerability exists due to incorrect processing of messages with a missing transfer-encoding header, when HAProxy is configured in legacy mode. The server does not reject "chunked" value that combined with the "http-reuse always" setting can lead to HTTP request smuggling attack.
2) CRLF injection (CVE-ID: CVE-2019-19330)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to insufficient validation of user-supplied input when processing CRLF and NUL character in the HTTP request, while converting headers from HTTP/2 to
HTTP/1. A remote attacker can send a specially crafted HTTP/2 request to the HAProxy and inject arbitrary HTTP headers. Successful exploitation of the vulnerability may allow an attacker to bypass certain security restrictions or perform spoofing attacks.
3) Heap-based buffer overflow (CVE-ID: CVE-2020-11100)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTTP/2 requests within the hpack_dht_insert() function in hpack-tbl.c (HPACK decoder). A remote attacker can send a specially crafted HTTP/2 request to the affected HAProxy, trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.