The vulnerability of the `dns_validate_dns_response` function in the `dns.c` component of the HAProxy network software allows a perpetrator to gain unauthorized access to protected information.

🗓️ 15 Jul 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

HAProxy dns_validate_dns_response flaw in dns.c enables remote access via out-of-bounds memory.

Reporter	Title	Published	Views	Family All 73
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in HAProxy affects IBM Watson Studio Local	20 Dec 201908:47	–	ibm
Tenable Nessus	Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-002)	27 Sep 202300:00	–	nessus
Tenable Nessus	Debian DLA-3034-1 : haproxy - LTS security update	31 May 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : haproxy (EulerOS-SA-2019-1650)	27 Jun 201900:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.3.0 : haproxy (EulerOS-SA-2019-2329)	3 Dec 201900:00	–	nessus
Tenable Nessus	openSUSE Security Update : haproxy (openSUSE-2019-44)	14 Jan 201900:00	–	nessus
Tenable Nessus	Photon OS 1.0: Haproxy PHSA-2019-1.0-0220	15 May 201900:00	–	nessus
Tenable Nessus	Photon OS 2.0: Haproxy PHSA-2019-2.0-0150	15 May 201900:00	–	nessus
Tenable Nessus	RHEL 7 : OpenShift Container Platform 3.9 haproxy (RHSA-2019:0547)	15 Mar 201900:00	–	nessus
Tenable Nessus	RHEL 7 : rh-haproxy18-haproxy (RHSA-2019:1436)	28 Apr 202400:00	–	nessus

Vulners

Node

novell suse_linux_enterprise_high_availabilityMatch15

OR

red_hat openshift_container_platformMatch3.11

OR

red_hat openshift_container_platformMatch3.9

OR

red_hat openshift_container_platformMatch3.7

OR

red_hat openshift_container_platformMatch3.10

OR

willy_terreau haproxyRange≤1.8.14

OR

canonical ubuntuMatch18.10

OR

novell opensuse_leapMatch15.0

Source	Link
git	www.git.haproxy.org/
access	www.access.redhat.com/errata/RHBA-2019:0326
access	www.access.redhat.com/errata/RHBA-2019:0327
access	www.access.redhat.com/errata/RHSA-2019:1436
access	www.access.redhat.com/security/cve/CVE-2018-20102
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-20102
security-tracker	www.security-tracker.debian.org/tracker/CVE-2018-20102
ubuntu	www.ubuntu.com/security/notices/USN-3858-1
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16
suse	www.suse.com/security/cve/CVE-2018-20102/

21 Nov 2023 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25

EPSS0.04347

HAProxy vulnerability dns vulnerability dns response out of bounds memory access remote attack