The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2265 advisory.

    HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments.

    The following packages have been upgraded to a later upstream version: rh-haproxy18-haproxy (1.8.24).
    (BZ#1774747)

    Security Fix(es):

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.5 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1287 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1936 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

  - haproxy: malformed HTTP/2 requests can lead to out-of-bounds writes (CVE-2020-11100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Tim Dusterhus discovered that haproxy, a TCP/HTTP reverse proxy, did not properly sanitize HTTP headers when converting from HTTP/2 to HTTP/1. This would allow a remote user to perform CRLF injections.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-267:02 advisory.

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)
      * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
170315	RHEL 7 : rh-haproxy18-haproxy (RHSA-2020:2265)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/11/7	critical
170348	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:1287)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/11/7	critical
312490	RHCOS 4 : OpenShift Container Platform 4.4.3 haproxy (RHSA-2020:1936)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	critical
131438	Debian DSA-4577-1 : haproxy - security update	Nessus	Debian Local Security Checks	2019/12/3	2019/12/18	critical
293941	MiracleLinux 8 : haproxy-1.8.23-3.el8 (AXSA:2020-267:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

critical

critical

critical

critical

critical