kritisch
CVE-2019-19330
haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Red Hat (mittel), Oracle (mittel), Ubuntu (mittel).
Beschreibung
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | haproxy | 2.0.10-1.ph1 |
| Photon OS 2.0 | haproxy | 2.0.10-1.ph2 |
| Photon OS 3.0 | haproxy | 2.0.10-1.ph3 |
| alpine 3.8 | haproxy | 1.8.23 |
| alpine 3.9 | haproxy | 1.8.23-r0 |
| debian 10 | haproxy | 1.8.19-1+deb10u1 |
| debian 11 | haproxy | 2.0.10-1 |
| debian 12 | haproxy | 2.0.10-1 |
| debian 13 | haproxy | 2.0.10-1 |
| debian 14 | haproxy | 2.0.10-1 |
| echo | haproxy | 2.0.10-1 |
| Oracle Linux 8 | haproxy | 1.8.23-3.el8 |
Alle 16 Einträge aus 16 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | haproxy | 2.0.10-1.ph1 |
| Photon OS 2.0 | haproxy | 2.0.10-1.ph2 |
| Photon OS 3.0 | haproxy | 2.0.10-1.ph3 |
| alpine 3.8 | haproxy | 1.8.23 |
| alpine 3.9 | haproxy | 1.8.23-r0 |
| debian 10 | haproxy | 1.8.19-1+deb10u1 |
| debian 11 | haproxy | 2.0.10-1 |
| debian 12 | haproxy | 2.0.10-1 |
| debian 13 | haproxy | 2.0.10-1 |
| debian 14 | haproxy | 2.0.10-1 |
| echo | haproxy | 2.0.10-1 |
| Oracle Linux 8 | haproxy | 1.8.23-3.el8 |
| ubuntu 18.04 | haproxy | 1.8.8-1ubuntu0.9 |
| ubuntu 18.04-ESM | haproxy | 1.8.8-1ubuntu0.9 |
| ubuntu 19.04 | haproxy | 1.8.19-1ubuntu1.3 |
| ubuntu 19.10 | haproxy | 2.0.5-1ubuntu0.3 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2019-19330
- https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e
- https://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95daae20954b3053ce87e
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=146f53ae7e97dbfe496d0445c2802dd0a30b0878
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=54f53ef7ce4102be596130b44c768d1818570344
- https://linux.oracle.com/cve/CVE-2019-19330.html
Alle 17 Referenzen
- https://linux.oracle.com/errata/ELSA-2020-1725.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19330
- https://seclists.org/bugtraq/2019/Nov/45
- https://security.gentoo.org/glsa/202004-01
- https://tools.ietf.org/html/rfc7540#section-10.3
- https://ubuntu.com/security/notices/USN-4212-1
- https://usn.ubuntu.com/4212-1/
- https://www.cve.org/CVERecord?id=CVE-2019-19330
- https://www.debian.org/security/2019/dsa-4577