CVE-2018-20103: High severity HAProxy HAProxy vulnerability
An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 1.8.15 - Upgrade
Upgrade
debian/haproxyto a version that resolves this vulnerability.Fixed in 2.2.9-2+deb11u6Fixed in 2.2.9-2+deb11u7Fixed in 2.6.12-1+deb12u3Fixed in 3.0.11-1+deb13u1Fixed in 3.0.11-1+deb13u2Fixed in 3.2.12-1Fixed in 3.2.13-1
Event History
Frequently Asked Questions
What is CVE-2018-20103?
CVE-2018-20103 is a vulnerability in HAProxy versions through 1.8.14 that allows for infinite recursion or stack exhaustion through a crafted packet.
How severe is CVE-2018-20103?
CVE-2018-20103 has a severity rating of 7.5, which is considered high.
How can I fix CVE-2018-20103?
To fix CVE-2018-20103, you should update to HAProxy version 1.8.15 or later.
Where can I find more information about CVE-2018-20103?
You can find more information about CVE-2018-20103 at the following references: [http://git.haproxy.org/?p=haproxy.git;a=commit;h=58df5aea0a0c926b2238f65908f5e9f83d1cca25](http://git.haproxy.org/?p=haproxy.git;a=commit;h=58df5aea0a0c926b2238f65908f5e9f83d1cca25), [http://www.securityfocus.com/bid/106280](http://www.securityfocus.com/bid/106280), [https://access.redhat.com/errata/RHBA-2019:0326](https://access.redhat.com/errata/RHBA-2019:0326).
What is the CWE number for CVE-2018-20103?
The CWE number for CVE-2018-20103 is 835.