CVE-2020-11100 Memory corruption in n/a
A remote attacker can achieve arbitrary code execution by sending a crafted HTTP/2 request that triggers a heap buffer overflow in the HPACK decoder.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11100?
CVE-2020-11100 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 2 Apr 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
Weakness: CWE-787
Which versions are affected by CVE-2020-11100?
1 open source package ship an affected version, including haproxy. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
haproxy Bitnami | From 1.8.0 | 2.1.4 |
Linux distribution packages (12)
haproxy Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.15-6.el8_1.1 |
haproxy-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.15-6.el8_1.1 |
haproxy-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.8.15-6.el8_1.1 |
haproxy Red Hat:rhel_e4s:8.0::appstream | All versions | 0:1.8.15-5.el8_0.1 |
haproxy-debuginfo Red Hat:rhel_e4s:8.0::appstream | All versions | 0:1.8.15-5.el8_0.1 |
haproxy-debugsource Red Hat:rhel_e4s:8.0::appstream | All versions | 0:1.8.15-5.el8_0.1 |
rh-haproxy18-haproxy Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.8.17-1.el7.1 |
rh-haproxy18-haproxy-debuginfo Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.8.17-1.el7.1 |
rh-haproxy18-haproxy-syspaths Red Hat:rhel_software_collections:3::el7 | All versions | 0:1.8.17-1.el7.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 15 | All versions | 2.0.10+git0.ac198b92-3.19.1 |
haproxy SUSE:Linux Enterprise High Availability Extension 15 SP1 | All versions | 2.0.10+git0.ac198b92-8.12.1 |
haproxy openSUSE:Leap 15.1 | All versions | 2.0.10+git0.ac198b92-lp151.2.9.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Haproxy Haproxy, Opensuse Leap, Redhat Openshift Container Platform.
How do I fix CVE-2020-11100?
Upgrade haproxy to 2.1.4 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-11100 being exploited?
There is no known exploitation of CVE-2020-11100 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2020-11100, BIT-haproxy-2020-11100, CLEANSTART-2026-RO35249, DEBIAN-CVE-2020-11100, DSA-4649-1, GHSA-3xcv-57q9-hrj2 and 8 more.