Vulnerability Description
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haproxy | Haproxy | < 2.0.10 |
| Canonical | Ubuntu Linux | 18.04 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95d
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c
- https://seclists.org/bugtraq/2019/Nov/45Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202004-01
- https://tools.ietf.org/html/rfc7540#section-10.3Third Party Advisory
- https://usn.ubuntu.com/4212-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4577Third Party Advisory
- https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95d
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c
- https://seclists.org/bugtraq/2019/Nov/45Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202004-01
- https://tools.ietf.org/html/rfc7540#section-10.3Third Party Advisory
- https://usn.ubuntu.com/4212-1/Third Party Advisory
FAQ
What is CVE-2019-19330?
CVE-2019-19330 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Inter...
How severe is CVE-2019-19330?
CVE-2019-19330 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-19330?
Check the references section above for vendor advisories and patch information. Affected products include: Haproxy Haproxy, Canonical Ubuntu Linux, Debian Debian Linux.