kritik
CVE-2019-19330
haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Photon OS. Daha düşük diyenler: Red Hat (orta), Oracle (orta), Ubuntu (orta).
Açıklama
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | haproxy | 2.0.10-1.ph1 |
| Photon OS 2.0 | haproxy | 2.0.10-1.ph2 |
| Photon OS 3.0 | haproxy | 2.0.10-1.ph3 |
| alpine 3.8 | haproxy | 1.8.23 |
| alpine 3.9 | haproxy | 1.8.23-r0 |
| debian 10 | haproxy | 1.8.19-1+deb10u1 |
| debian 11 | haproxy | 2.0.10-1 |
| debian 12 | haproxy | 2.0.10-1 |
| debian 13 | haproxy | 2.0.10-1 |
| debian 14 | haproxy | 2.0.10-1 |
| echo | haproxy | 2.0.10-1 |
| Oracle Linux 8 | haproxy | 1.8.23-3.el8 |
16 kaynaktaki 16 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | haproxy | 2.0.10-1.ph1 |
| Photon OS 2.0 | haproxy | 2.0.10-1.ph2 |
| Photon OS 3.0 | haproxy | 2.0.10-1.ph3 |
| alpine 3.8 | haproxy | 1.8.23 |
| alpine 3.9 | haproxy | 1.8.23-r0 |
| debian 10 | haproxy | 1.8.19-1+deb10u1 |
| debian 11 | haproxy | 2.0.10-1 |
| debian 12 | haproxy | 2.0.10-1 |
| debian 13 | haproxy | 2.0.10-1 |
| debian 14 | haproxy | 2.0.10-1 |
| echo | haproxy | 2.0.10-1 |
| Oracle Linux 8 | haproxy | 1.8.23-3.el8 |
| ubuntu 18.04 | haproxy | 1.8.8-1ubuntu0.9 |
| ubuntu 18.04-ESM | haproxy | 1.8.8-1ubuntu0.9 |
| ubuntu 19.04 | haproxy | 1.8.19-1ubuntu1.3 |
| ubuntu 19.10 | haproxy | 2.0.5-1ubuntu0.3 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2019-19330
- https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e
- https://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95daae20954b3053ce87e
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=146f53ae7e97dbfe496d0445c2802dd0a30b0878
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=54f53ef7ce4102be596130b44c768d1818570344
- https://linux.oracle.com/cve/CVE-2019-19330.html
17 referansın hepsi
- https://linux.oracle.com/errata/ELSA-2020-1725.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19330
- https://seclists.org/bugtraq/2019/Nov/45
- https://security.gentoo.org/glsa/202004-01
- https://tools.ietf.org/html/rfc7540#section-10.3
- https://ubuntu.com/security/notices/USN-4212-1
- https://usn.ubuntu.com/4212-1/
- https://www.cve.org/CVERecord?id=CVE-2019-19330
- https://www.debian.org/security/2019/dsa-4577