Stay Secure with the Latest Linux Advisories

security advisorysecurity issuebug fix

Red Hat: RHSA-2020-2265-01 Moderate: rh-haproxy18-haproxy Security Issue

An update for rh-haproxy18-haproxy is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-haproxy18-haproxy security, bug fix, and enhancement update Advisory ID: RHSA-2020:2265-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2020:2265 Issue date: 2020-05-26 CVE Names: CVE-2019-18277 CVE-2019-19330 ==================================================================== 1. Summary: An update for rh-haproxy18-haproxy is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. The following packages have been upgraded to a later upstream version: rh-haproxy18-haproxy (1.8.24). (BZ#1774747) Security Fix(es): * haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated "chunked" value (CVE-2019-18277) * haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330) For more detailsabout the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Software Collections 3.5 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1759697 - CVE-2019-18277 haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated "chunked" value 1774747 - Rebase rhscl/haproxy to latest upstream for RHSCL 3.5 1777584 - CVE-2019-19330 haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-haproxy18-haproxy-1.8.24-2.el7.src.rpm x86_64: rh-haproxy18-haproxy-1.8.24-2.el7.x86_64.rpm rh-haproxy18-haproxy-debuginfo-1.8.24-2.el7.x86_64.rpm rh-haproxy18-haproxy-syspaths-1.8.24-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6): Source: rh-haproxy18-haproxy-1.8.24-2.el7.src.rpm x86_64: rh-haproxy18-haproxy-1.8.24-2.el7.x86_64.rpm rh-haproxy18-haproxy-debuginfo-1.8.24-2.el7.x86_64.rpm rh-haproxy18-haproxy-syspaths-1.8.24-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7): Source: rh-haproxy18-haproxy-1.8.24-2.el7.src.rpm x86_64: rh-haproxy18-haproxy-1.8.24-2.el7.x86_64.rpm rh-haproxy18-haproxy-debuginfo-1.8.24-2.el7.x86_64.rpm rh-haproxy18-haproxy-syspaths-1.8.24-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-haproxy18-haproxy-1.8.24-2.el7.src.rpm x86_64: rh-haproxy18-haproxy-1.8.24-2.el7.x86_64.rpm rh-haproxy18-haproxy-debuginfo-1.8.24-2.el7.x86_64.rpm rh-haproxy18-haproxy-syspaths-1.8.24-2.el7.x86_64.rpm Thesepackages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-18277 https://access.redhat.com/security/cve/CVE-2019-19330 https://access.redhat.com/security/updates/classification/#moderate https://docs.redhat.com/en/documentation/red_hat_software_collections/3/html/3.5_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXszG49zjgjWX9erEAQigaxAAj6HXBsWFK9Yk6JfuJMPUUdxVq0e4spZS GscUoW8SRvEwBjoSb+ZFEJJ4kdkTUA9+0W5Oh0FYKhue0OUYDYP5XQiuxVBdLoKE mpcxudma3FVAnoDwVW1ooxB80zgND6q3prWrJMDI/djBDsblkfZCRrkWybc15i6n B74pnOSkvbwUcgZmeBRhmpMsT7NRYyQM/9JvKE4DxymEZ7REDJ+PVpEeMETmIbl+ jooJ6iEJitxtyVi7QKgIrrlNJf91aqpb9yvISkSX3E6x/zknJ/+FTPiYxoqbCrN2 PrYCUhCqI1OUHjLqPVB9crbW50qb7lXn2r/jjY34nPY+sQNjZzw3haHwoNFC6YRI f6ztjX3pcHnzLVPhtHb3Ma7TFXHiVOrGROeGfTGjWtby0+30ass1AF+v8sulUHOD hMuh15TIvuii0oDwe+YYs0bzmnZfTGRftO6f/NvoakXtnmwEFUn5WgP438BDqE/f GJUoMS0Kqu6ddztQlh4yuyzWJS/l80eo5LLlDxSpInKEQGll1h5cBktahp4ZOBCC I4RYaqwNuBOf+j5mKxbRD92DgCCqRseikwwn8hEjqGZf+tJQiraUScjXz8P3FvEg jhwgThbEXozyAq+1ryaund5sZ4DLo+rjfDX8mATkkPWQ69J5WuHPuJvDyc2b3zin cbAzdDyvKM0=S7eI -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Explore Red Hat's Security Advisory RHSA-2021:1234-01 regarding rh-haproxy18-haproxy, which tackles various identified vulnerabilities.. Red Hat Advisory, rh-haproxy, security update, vulnerability report, bug fixes. . LinuxSecurity.com Team

May 26, 2020 Red Hat