CVE-2019-19330

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e
https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878
https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344
https://seclists.org/bugtraq/2019/Nov/45	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202004-01
https://tools.ietf.org/html/rfc7540#section-10.3	Third Party Advisory
https://usn.ubuntu.com/4212-1/	Third Party Advisory
https://www.debian.org/security/2019/dsa-4577	Third Party Advisory
https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e
https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878
https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344
https://seclists.org/bugtraq/2019/Nov/45	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202004-01
https://tools.ietf.org/html/rfc7540#section-10.3	Third Party Advisory
https://usn.ubuntu.com/4212-1/	Third Party Advisory
https://www.debian.org/security/2019/dsa-4577	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

History

21 Nov 2024, 04:34

Type	Values Removed	Values Added
References	~~() https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e -~~	() https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e -
References	~~() https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878 -~~	() https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878 -
References	~~() https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344 -~~	() https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344 -
References	~~() https://seclists.org/bugtraq/2019/Nov/45 - Mailing List, Third Party Advisory~~	() https://seclists.org/bugtraq/2019/Nov/45 - Mailing List, Third Party Advisory
References	~~() https://security.gentoo.org/glsa/202004-01 -~~	() https://security.gentoo.org/glsa/202004-01 -
References	~~() https://tools.ietf.org/html/rfc7540#section-10.3 - Third Party Advisory~~	() https://tools.ietf.org/html/rfc7540#section-10.3 - Third Party Advisory
References	~~() https://usn.ubuntu.com/4212-1/ - Third Party Advisory~~	() https://usn.ubuntu.com/4212-1/ - Third Party Advisory
References	~~() https://www.debian.org/security/2019/dsa-4577 - Third Party Advisory~~	() https://www.debian.org/security/2019/dsa-4577 - Third Party Advisory

07 Nov 2023, 03:07

Type	Values Removed	Values Added
References	{'url': 'https://git.haproxy.org/?p=haproxy.git;a=commit;h=146f53ae7e97dbfe496d0445c2802dd0a30b0878', 'name': 'https://git.haproxy.org/?p=haproxy.git;a=commit;h=146f53ae7e97dbfe496d0445c2802dd0a30b0878', 'tags': ['Patch'], 'refsource': 'MISC'} {'url': 'https://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95daae20954b3053ce87e', 'name': 'https://git.haproxy.org/?p=haproxy-2.0.git;a=commit;h=ac198b92d461515551b95daae20954b3053ce87e', 'tags': ['Patch'], 'refsource': 'MISC'} {'url': 'https://git.haproxy.org/?p=haproxy.git;a=commit;h=54f53ef7ce4102be596130b44c768d1818570344', 'name': 'https://git.haproxy.org/?p=haproxy.git;a=commit;h=54f53ef7ce4102be596130b44c768d1818570344', 'tags': ['Patch'], 'refsource': 'MISC'}	() https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344 - () https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e - () https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878 -

Information

Published : 2019-11-27 16:15

Updated : 2024-11-21 04:34

NVD link : CVE-2019-19330

Mitre link : CVE-2019-19330

CVE.ORG link : CVE-2019-19330

JSON object : View

Products Affected

canonical

ubuntu_linux

haproxy

haproxy

debian

debian_linux

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

9.8 /10