Red Hat Security Advisory 2018-2882-01 - HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Issues addressed include an out-of-bounds read.
704c6d8910906768ab26688d3013c5047b43b29f16be67bc61a5180637772295
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: rh-haproxy18-haproxy security update
Advisory ID: RHSA-2018:2882-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2882
Issue date: 2018-10-08
CVE Names: CVE-2018-14645
=====================================================================
1. Summary:
An update for rh-haproxy18-haproxy is now available for Red Hat Software
Collections.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64
3. Description:
HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high
availability environments.
Security Fix(es):
* haproxy: Out-of-bounds read in HPACK decoder (CVE-2018-14645)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Red Hat would like to thank Tim DA1/4sterhus and Willy Tarreau for reporting
this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1630048 - CVE-2018-14645 haproxy: Out-of-bounds read in HPACK decoder
6. Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source:
rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm
x86_64:
rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):
Source:
rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm
x86_64:
rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4):
Source:
rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm
x86_64:
rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5):
Source:
rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm
x86_64:
rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source:
rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm
x86_64:
rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm
rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-14645
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBW7ssENzjgjWX9erEAQg7SxAAhGVGIfeMo7neGoPtHAkOU8NllGioOVtW
5FV/6ex3PgiU4eBExFsKOclA7w/cFJhQ3/H+5Zw7kvfSGaLbwHCJf3+3/jBB+6bt
yTG7VJFeIfb60CiiF5hd22HS+BLf/Sa2aJNQptOJahaz9caMVr5YsdmdKFAVUB4V
vRZ164pKcVbwiZJVowOkK8clf01Q8XWmC1I9ChcZSuEYYhGA8b+J4Tr7jrl9f5ab
Nmzp+FJQkaHDLFc8y2XEpoNdvIxkWmnO5XigLhKXl4SltwrEWLUniVdw6d1e1W8f
Nzbp4AxwCt6NOrltfNgwHow7BoqNY8UaxEIOC9ABJZrZ5pbaOTRp7SJwi5v1S4sL
ZQVMdcebN75DKJzvvQq/X8/VtdFjkBMC37b+xV+Vl31CuaYNgoOeKU1FXfz0kX47
Lz9gFDS6XNT9ckNtG136U0USPJDbgPvQTnmI9JgqZOWBhnUWP8GgE8u4DJxMzdQK
hDtq1oYa6DpPDohUoUkmo1EdsmfaM/Y8wF7XrkxzbgNF0aqLs92FmjzmXiddisUy
ji7Fh6fLxKxkk09cg30xzFSUJ8n6GN8DaLeYTJvoeHrCxkfqsEeudlZ3xEzn9l2A
AhfhOJcrby/eWyzDE1pT8nr9eu0hDGzTF/AVPzyYdN+DWHt2PD4Sx4ozOheFECnC
Rkwi+9Pr6EA=
=q8Ho
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce