CVE-2018-20615
High
Description
An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Haproxy
PublishedMar 21, 2019
First seenMar 21, 2019
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haproxy haproxy | 1.8.0 ≤ v ≤ 1.8.19, 1.9.0 | — |
| opensuse leap | 15.0 | — |
| canonical ubuntu_linux | 16.04, 18.04, 18.10 | — |
| redhat openshift_container_platform | 3.11 | — |
| redhat enterprise_linux | 7.0, 7.4, 7.5, 7.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.