CVEvulnerability
CVE-2019-19330
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-11-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-74
Description
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
Affected configurations
• haproxy haproxy (< 2.0.10)
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.04
• canonical ubuntu linux 19.10
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e git.haproxy.org
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878 git.haproxy.org
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344 git.haproxy.org
- https://seclists.org/bugtraq/2019/Nov/45 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202004-01 security.gentoo.org
- https://tools.ietf.org/html/rfc7540#section-10.3 Third Party Advisory
- https://usn.ubuntu.com/4212-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4577 Third Party Advisory
- https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e git.haproxy.org
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878 git.haproxy.org
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344 git.haproxy.org
- https://seclists.org/bugtraq/2019/Nov/45 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202004-01 security.gentoo.org
- https://tools.ietf.org/html/rfc7540#section-10.3 Third Party Advisory
- https://usn.ubuntu.com/4212-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4577 Third Party Advisory