Red Hat Security Advisory: OpenShift Container Platform 4.4.3 haproxy security update
An update for haproxy is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-11100US | high8.8 | — | ||
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap v… | ||||
| CVE-2019-19330US | critical9.8 | — | ||
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, A… | ||||
| CVE-2019-18277US | high7.5 | — | ||
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact wa… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2020:1936self
- https://access.redhat.com/security/updates/classification/#moderateexternal
- 1759697external
- 1777584external
- 1819111external
- Canonical URLself
Behebungen (35)
- Behobenhaproxy-0:2.0.13-3.el7.src as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-0:2.0.13-3.el7.src as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-0:2.0.13-3.el7.src as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-0:2.0.13-3.el8.src as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-0:2.0.13-3.el8.src as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-0:2.0.13-3.el8.src as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-debuginfo-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-debuginfo-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-debuginfo-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-debugsource-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-debugsource-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy-debugsource-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy20-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy20-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy20-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy20-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy20-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy20-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy20-debuginfo-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy20-debuginfo-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Behobenhaproxy20-debuginfo-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.3, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:1936 - Workaroundhaproxy-0:2.0.13-3.el7.src as a component of Red Hat OpenShift Container Platform 4.4
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy-0:2.0.13-3.el7.src as a component of Red Hat OpenShift Container Platform 4.4
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy-0:2.0.13-3.el8.src as a component of Red Hat OpenShift Container Platform 4.4
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy-0:2.0.13-3.el8.src as a component of Red Hat OpenShift Container Platform 4.4
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy-debuginfo-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy-debuginfo-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy-debugsource-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy-debugsource-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy20-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy20-0:2.0.13-3.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy20-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy20-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
- Workaroundhaproxy20-debuginfo-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
- Reconsider the use of `http-reuse always` if possible - Disable HTTP Keep-Alive (also called HTTP Connection reuse) in the backend - Fix the backend server to correctly parse Transfer-Encoding/Content-Length headers
- Workaroundhaproxy20-debuginfo-0:2.0.13-3.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4
This issue can be mitigated by not enabling support for HTTP/2 protocol. Upstream suggests that HTTP/2 can be enabled per front-end server by using the following documentation: https://www.haproxy.com/documentation/hapee/1-8r1/traffic-management/enable-http2-protocol/. You can check if http2 is enabled by searching your haproxy configuration files for a line containing 'h2'. To mitigate this vulnerability in OpenShift Container Platform 3.11, keep HTTP/2 disabled as it is by default. You can verify if HTTP/2 support is enabled or not by following the instructions in following article: https://access.redhat.com/security/vulnerabilities/haproxy On Red Hat Enterprise Linux 8, haproxy is confined by SELinux, which should mitigate remote arbitrary code execution.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan