The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1725 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    The following packages have been upgraded to a later upstream version: haproxy (1.8.23). (BZ#1774745)

    Security Fix(es):

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1936 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * haproxy: malformed HTTP/2 requests could lead to out-of-bounds writes (CVE-2020-11100)

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

    * haproxy: HTTP/2 implementation was vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4212-1 advisory.

    Tim Dsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers. An attacker could     possibly use this issue to execute arbitrary code through CRLF injection.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-267:02 advisory.

    * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)
      * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Tim Dusterhus discovered that haproxy, a TCP/HTTP reverse proxy, did not properly sanitize HTTP headers when converting from HTTP/2 to HTTP/1. This would allow a remote user to perform CRLF injections.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
136052	RHEL 8 : haproxy (RHSA-2020:1725)	Nessus	Red Hat Local Security Checks	2020/4/28	2024/11/7	critical
136319	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 haproxy (RHSA-2020:1936)	Nessus	Red Hat Local Security Checks	2020/5/5	2024/11/7	critical
131722	Ubuntu 18.04 LTS : HAProxy vulnerability (USN-4212-1)	Nessus	Ubuntu Local Security Checks	2019/12/5	2024/8/27	critical
293941	MiracleLinux 8 : haproxy-1.8.23-3.el8 (AXSA:2020-267:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
131438	Debian DSA-4577-1 : haproxy - security update	Nessus	Debian Local Security Checks	2019/12/3	2019/12/18	critical

检测

插件搜索

critical

critical

critical

critical

critical