CVE-2020-11100

CVE-2020-11100

Published · Updated

Follow this CVE+ Monitor haproxy+ Monitor haproxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

15Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 62%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
9 products (52 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream E4S (v. 8.0) · Red Hat OpenShift Container Platform 4.4 · Red Hat OpenShift Container Platform 3.11 · Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · and others 4
fix ↗
Not affected
2 products (4 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
Affected products
n/a · n/a