CVE-2018-20103

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 12-12-2018 06:29

Last modified: - 02-06-2022 04:15

Total changes: - 2

Description

An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

Common Vulnerability Scoring System (CVSS)

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

None

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

7.5

Base score

3.9

3.6

Exploitability score

Impact score

Verification logic

vendor=haproxy AND product=haproxy AND versionEndIncluding=1.8.14

vendor=canonical AND product=ubuntu_linux AND version=16.04 AND software_edition=lts

vendor=canonical AND product=ubuntu_linux AND version=18.04 AND software_edition=lts

vendor=canonical AND product=ubuntu_linux AND version=18.10

vendor=Red Hat Enterprise Linux AND product=openshift_container_platform AND version=3.11

Reference

http://git.haproxy.org/?p=haproxy.git;a=commit;h=58df5aea0a0c926b2238f65908f5e9f83d1cca25
106280-Third Party Advisory, VDB Entry
USN-3858-1-Third Party Advisory
RHBA-2019:0326-Third Party Advisory
RHBA-2019:0327-Third Party Advisory
RHSA-2019:1436-
[debian-lts-announce] 20220530 [SECURITY] [DLA 3034-1] haproxy security update-

Keywords

CVE-2018-20103

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2018-20103

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures