CVE-2020-11100: haproxy +5 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-11100

CVSS 8.8 · High EPSS 61,6%

Kerentanan Out-of-bounds Write pada haproxy, debian linux +4 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.

Rincian

Terbit di NVD: 2 April 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-787: Out-of-bounds Write
EPSS (30 hari): 61,6% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
haproxy	haproxy	Versi 1.8.0 hingga sebelum 2.1.4
debian	debian linux	Versi 10.0
redhat	openshift container platform	Versi 3.11
redhat	openshift container platform	Versi 4.0
fedoraproject	fedora	Versi 30
fedoraproject	fedora	Versi 31
canonical	ubuntu linux	Versi 18.04
canonical	ubuntu linux	Versi 19.10
opensuse	leap	Versi 15.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.haproxy.org advisory vendor
https://www.haproxy.org/download/2.1/src/CHANGELOG release notes · advisory vendor
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00002.html mailing list · advisory pihak ketiga
http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html advisory pihak ketiga · vdb entry
https://bugzilla.redhat.com/show_bug.cgi?id=1819111 issue tracking · advisory pihak ketiga
https://bugzilla.suse.com/show_bug.cgi?id=1168023 issue tracking · advisory pihak ketiga
https://lists.debian.org/debian-security-announce/2020/msg00052.html mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202012-22 advisory pihak ketiga
https://usn.ubuntu.com/4321-1/ advisory pihak ketiga
https://www.debian.org/security/2020/dsa-4649 advisory pihak ketiga
https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/264C7UL3X7L7Q...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNW5RZLIX7LOX...
https://www.mail-archive.com/haproxy%40formilux.org/msg36876.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.