UBUNTU-CVE-2019-19330

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

References

Affected packages

Ubuntu:18.04:LTS / haproxy

Package

Name: haproxy
Purl: pkg:deb/ubuntu/haproxy@1.8.8-1ubuntu0.9?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.8-1ubuntu0.9

Affected versions

1.*

1.7.9-1ubuntu1

1.7.9-1ubuntu2

1.8.4-1

1.8.7-1

1.8.8-1

1.8.8-1ubuntu0.1

1.8.8-1ubuntu0.2

1.8.8-1ubuntu0.3

1.8.8-1ubuntu0.4

1.8.8-1ubuntu0.6

1.8.8-1ubuntu0.7

1.8.8-1ubuntu0.8

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "haproxy",
            "binary_version": "1.8.8-1ubuntu0.9"
        },
        {
            "binary_name": "haproxy-dbgsym",
            "binary_version": "1.8.8-1ubuntu0.9"
        },
        {
            "binary_name": "haproxy-doc",
            "binary_version": "1.8.8-1ubuntu0.9"
        },
        {
            "binary_name": "vim-haproxy",
            "binary_version": "1.8.8-1ubuntu0.9"
        }
    ],
    "availability": "No subscription required"
}