p PatchFirst

CVE-2019-19330

CVE-2019-19330

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

CVSS 9.8 · Critical · EPSS 4.0% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • haproxy Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.0.10-1

    Update to 2.0.10-1

  • haproxy Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.0.10-1

    Update to 2.0.10-1

  • haproxy Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.0.10-1

    Update to 2.0.10-1

  • haproxy Ubuntu:18.04:LTS

    Versions
    • 1.7.9-1ubuntu1
    • 1.7.9-1ubuntu2
    • 1.8.4-1
    • 1.8.7-1
    • 1.8.8-1
    • 1.8.8-1ubuntu0.1
    • 1.8.8-1ubuntu0.2
    • 1.8.8-1ubuntu0.3
    • 1.8.8-1ubuntu0.4
    • 1.8.8-1ubuntu0.6
    • 1.8.8-1ubuntu0.7
    • 1.8.8-1ubuntu0.8
    Affected ranges
    • ECOSYSTEM: < 1.8.8-1ubuntu0.9

    Update to 1.8.8-1ubuntu0.9

Original sources

Check your server →