The vulnerability of the hpack_dht_insert function in the HAProxy networking software library, located in the hpack-tbl.c file, allows for unauthorized access to confidential data by exceeding the allowed buffer size. This vulnerability enables attackers to cause service failures or compromise data integrity.

🗓️ 13 May 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Vulnerability in HAProxy hpack_dht_insert allows buffer overrun via HTTP two, risking unauthorized data access and integrity.

Reporter	Title	Published	Views	Family All 96
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities were identified in IBM Security Verify Access.	9 Jan 202420:27	–	ibm
IBM Security Bulletins	Security Bulletin: HAProxy vulnerability CVE-2020-11100 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0	10 Dec 202023:21	–	ibm
FreeBSD	HAproxy -- serious vulnerability affecting the HPACK decoder used for HTTP/2	2 Apr 202000:00	–	freebsd
ATTACKERKB	CVE-2020-11100	2 Apr 202000:00	–	attackerkb
Tenable Nessus	Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-006)	27 Sep 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0043: haproxy (ALINUX3-SA-2022:0043)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : haproxy (CESA-2020:1288)	1 Feb 202100:00	–	nessus
Tenable Nessus	Debian DSA-4649-1 : haproxy - security update	14 Apr 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2020-1580)	26 May 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : haproxy (EulerOS-SA-2020-1709)	25 Jun 202000:00	–	nessus

Vulners

Node

red_hat openshift_container_platformMatch3.11

OR

willy_terreau haproxyRange1.8.0–2.1.4

OR

red_hat openshift_container_platformMatch4.4

OR

red_hat red_hat_enterprise_linuxMatch8

OR

novell opensuse_leapMatch15.1

OR

fedora fedoraMatch30

OR

fedora fedoraMatch31

OR

canonical ubuntuMatch19.10

Source	Link
lists	www.lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.html
access	www.access.redhat.com/security/cve/CVE-2020-11100
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/264C7UL3X7L7QE74ZJ557IOUFS3J4QQC/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/MNW5RZLIX7LOXRLV7WMHX22CI43XSXKW/
usn	www.usn.ubuntu.com/4321-1/
git	www.git.haproxy.org/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-11100
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-11100
web	www.web.nvd.nist.gov/view/vuln/detail

25 Mar 2021 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 38.8

CVSS 29

EPSS0.60727

haproxy buffer overrun hpack dht insert http two requests unauthorized access data integrity