RHSA-2020:1290

csafUSredhat_csaf

Red Hat Security Advisory: rh-haproxy18-haproxy security update

view advisory published 2020-04-02

An update for rh-haproxy18-haproxy is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2020-11100UShigh8.8—
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap v…
02

references

External citations — patches, advisories, analysis.

03

remediations (40)

  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Fixedrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2020:1290
  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-debuginfo-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

  • Workaroundrh-haproxy18-haproxy-syspaths-0:1.8.17-1.el7.1.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

    This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan