5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.009 Low
EPSS
Percentile
82.5%
Severity: Medium
Date : 2019-01-24
CVE-ID : CVE-2018-20102 CVE-2018-20103
Package : haproxy
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-836
The package haproxy before version 1.9.0-1 is vulnerable to denial of
service.
Upgrade to 1.9.0-1.
The problems have been fixed upstream in version 1.9.0.
None.
A stack-based out-of-bounds read has been found in HAProxy before
1.8.15, in the dns_validate_dns_response() function in dns.c, where it
can be triggered by a crafted DNS packet.
A stack-exhaustion issue has been found in HAProxy before 1.8.15, in
the dns_read_name() function in dns.c, where an infinite recursion can
be triggered via a crafted DNS packet.
A remote attacker is able to crash the server with a specially crafted
DNS packet.
https://www.mail-archive.com/[email protected]/msg32055.html
https://git.haproxy.org/?p=haproxy-1.8.git;a=commitdiff;h=2e53fe850be462dab2c1141f044a94d248d68bfe
https://git.haproxy.org/?p=haproxy-1.8.git;a=commitdiff;h=12e27845513f87fe2df88e5795d0273f0b992a91
https://git.haproxy.org/?p=haproxy-1.8.git;a=commitdiff;h=2b514b24f71af8ff8c6593636850b9a312a05278
https://security.archlinux.org/CVE-2018-20102
https://security.archlinux.org/CVE-2018-20103
git.haproxy.org/?p=haproxy-1.8.git;a=commitdiff;h=12e27845513f87fe2df88e5795d0273f0b992a91
git.haproxy.org/?p=haproxy-1.8.git;a=commitdiff;h=2b514b24f71af8ff8c6593636850b9a312a05278
git.haproxy.org/?p=haproxy-1.8.git;a=commitdiff;h=2e53fe850be462dab2c1141f044a94d248d68bfe
security.archlinux.org/AVG-836
security.archlinux.org/CVE-2018-20102
security.archlinux.org/CVE-2018-20103
www.mail-archive.com/[email protected]/msg32055.html
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.009 Low
EPSS
Percentile
82.5%