CVE-2018-14645: High severity HAProxy HAProxy vulnerability
A flaw was discovered in the HPACK decoder of haproxy before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpackvalididx() resulted in a remote crash and denial of service. According to the report, there is no risk of escalation or code execution.
Other sources
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpackvalididx() resulted in a remote crash and denial of service.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 1.8.14 - Upgrade
Upgrade
debian/haproxyto a version that resolves this vulnerability.Fixed in 2.2.9-2+deb11u6Fixed in 2.2.9-2+deb11u7Fixed in 2.6.12-1+deb12u3Fixed in 3.0.11-1+deb13u1Fixed in 3.0.11-1+deb13u2Fixed in 3.2.12-1Fixed in 3.2.13-1 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 1.8.14
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-14645.
What is the severity of CVE-2018-14645?
The severity of CVE-2018-14645 is high with a CVSS score of 7.5.
What is the affected software?
The affected software includes HAProxy versions before 1.8.14 and some versions of Ubuntu, Debian, Redhat, and Haproxy.
How can I fix CVE-2018-14645?
You can fix CVE-2018-14645 by updating HAProxy to version 1.8.14 or newer.
Where can I find more information about CVE-2018-14645?
You can find more information about CVE-2018-14645 on the Red Hat website and Bugzilla.