Red Hat Security Advisory: OpenShift Container Platform 3.11 security update

Fixed packages 3

Vulnerabilities 3

• Unscored —
  CVE-2019-18277 EPSS 10%

  A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "ch…

  haproxy haproxy Debian Ubuntu
  Oct 23, 2019
• Unscored —
  CVE-2019-19330

  The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0x…

  haproxy haproxy haproxy Debian Ubuntu Alpine
  Nov 27, 2019
• Unscored —
  CVE-2020-11100 EPSS 62%

  In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can …

  haproxy haproxy haproxy Debian Ubuntu Alpine
  Apr 2, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1759697
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1777584
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1819111
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1287.json
• report
  https://access.redhat.com/security/cve/CVE-2019-18277
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-18277
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-18277
• report
  https://access.redhat.com/security/cve/CVE-2019-19330
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-19330
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-19330
• report
  https://access.redhat.com/security/cve/CVE-2020-11100
• article
  https://access.redhat.com/security/vulnerabilities/haproxy
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11100
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11100
• article
  https://bugs.chromium.org/p/project-zero/issues/detail?id=2023
• article
  https://www.haproxy.com/blog/haproxy-1-8-http-2-hpack-decoder-vulnerability-fixed/
• article
  https://www.mail-archive.com/haproxy@formilux.org/msg36876.html