The vulnerability of the server software HAProxy arises from improper handling of HTTP headers during the conversion from HTTP/2 to HTTP/1. This allows attackers to access sensitive data, compromise its integrity, and cause service failures.

🗓️ 13 May 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 8 Views

HAProxy header flaw in two to one conversion may allow attackers to access data and cause service failures.

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities were identified in IBM Security Verify Access.	9 Jan 202420:27	–	ibm
IBM Security Bulletins	Security Bulletin: HAProxy vulnerability CVE-2019-19330 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0	10 Dec 202023:19	–	ibm
AlpineLinux	CVE-2019-19330	27 Nov 201915:53	–	alpinelinux
Tenable Nessus	CentOS 8 : haproxy (CESA-2020:1725)	1 Feb 202100:00	–	nessus
Tenable Nessus	Debian DSA-4577-1 : haproxy - security update	3 Dec 201900:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2020-1805)	30 Jul 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : haproxy (EulerOS-SA-2020-1904)	28 Aug 202000:00	–	nessus
Tenable Nessus	GLSA-202004-01 : HAProxy: Remote execution of arbitrary code	2 Apr 202000:00	–	nessus
Tenable Nessus	MiracleLinux 8 : haproxy-1.8.23-3.el8 (AXSA:2020-267:02)	20 Jan 202600:00	–	nessus
Tenable Nessus	Oracle Linux 8 : haproxy (ELSA-2020-1725)	7 Sep 202300:00	–	nessus

Vulners

Node

OR

red_hat openshift_container_platformMatch3.11

red_hat openshift_container_platformMatch4.4

willy_terreau haproxyRange<2.0.10

canonical ubuntuMatch19.04

red_hat red_hat_enterprise_linuxMatch8

canonical ubuntuMatch19.10

Source	Link
access	www.access.redhat.com/security/cve/CVE-2019-19330
usn	www.usn.ubuntu.com/4212-1/
git	www.git.haproxy.org/
git	www.git.haproxy.org/
git	www.git.haproxy.org/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-19330
security-tracker	www.security-tracker.debian.org/tracker/CVE-2019-19330
web	www.web.nvd.nist.gov/view/vuln/detail

25 Mar 2021 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 39.8

CVSS 210

EPSS0.03955

haproxy header flaw two to one data access service failures