Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 19.10: USN-4212-1 Critical: haproxy HTTP/2 Header Issue

ubuntu
Calendar Grey December 4, 2019
Dist Ubuntu Esm H88
A security flaw in HAProxy for Ubuntu enables potential remote code execution through manipulated HTTP/2 headers. Instructions for the update are provided.
HAProxy could be made to execute arbitrary code if it received a specially crafted HTTP/2 header.

Summary

HAProxy could be made to execute arbitrary code if it received a specially crafted HTTP/2 header.

Software Description:

- haproxy: fast and reliable load balancing reverse proxy

Details:

Tim Düsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers.

An attacker could possibly use this issue to execute arbitrary code through CRLF injection.

Topics%20covered

Topics Covered

security advisory critical remote code execution ubuntu haproxy http/2 header

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  haproxy                         2.0.5-1ubuntu0.3

Ubuntu 19.04:
  haproxy                         1.8.19-1ubuntu1.3

Ubuntu 18.04 LTS:
  haproxy                         1.8.8-1ubuntu0.9

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4212-1

CVE-2019-19330

Severity
critical
Lowest
Low
Medium
High
Critical

December 04, 2019

Topics%20covered

Topics Covered

security advisory critical remote code execution ubuntu haproxy http/2 header

Package Information

https://launchpad.net/ubuntu/+source/haproxy/2.0.5-1ubuntu0.3
https://launchpad.net/ubuntu/+source/haproxy/1.8.19-1ubuntu1.3
https://launchpad.net/ubuntu/+source/haproxy/1.8.8-1ubuntu0.9

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here