-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: rh-haproxy18-haproxy security update Advisory ID: RHSA-2018:2882-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2018:2882 Issue date: 2018-10-08 CVE Names: CVE-2018-14645 ===================================================================== 1. Summary: An update for rh-haproxy18-haproxy is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Security Fix(es): * haproxy: Out-of-bounds read in HPACK decoder (CVE-2018-14645) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Tim DA1/4sterhus and Willy Tarreau for reporting this issue. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1630048 - CVE-2018-14645 haproxy: Out-of-bounds read in HPACK decoder 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm x86_64: rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3): Source: rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm x86_64: rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4): Source: rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm x86_64: rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5): Source: rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm x86_64: rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-haproxy18-haproxy-1.8.4-3.el7.src.rpm x86_64: rh-haproxy18-haproxy-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-debuginfo-1.8.4-3.el7.x86_64.rpm rh-haproxy18-haproxy-syspaths-1.8.4-3.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-14645 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW7ssENzjgjWX9erEAQg7SxAAhGVGIfeMo7neGoPtHAkOU8NllGioOVtW 5FV/6ex3PgiU4eBExFsKOclA7w/cFJhQ3/H+5Zw7kvfSGaLbwHCJf3+3/jBB+6bt yTG7VJFeIfb60CiiF5hd22HS+BLf/Sa2aJNQptOJahaz9caMVr5YsdmdKFAVUB4V vRZ164pKcVbwiZJVowOkK8clf01Q8XWmC1I9ChcZSuEYYhGA8b+J4Tr7jrl9f5ab Nmzp+FJQkaHDLFc8y2XEpoNdvIxkWmnO5XigLhKXl4SltwrEWLUniVdw6d1e1W8f Nzbp4AxwCt6NOrltfNgwHow7BoqNY8UaxEIOC9ABJZrZ5pbaOTRp7SJwi5v1S4sL ZQVMdcebN75DKJzvvQq/X8/VtdFjkBMC37b+xV+Vl31CuaYNgoOeKU1FXfz0kX47 Lz9gFDS6XNT9ckNtG136U0USPJDbgPvQTnmI9JgqZOWBhnUWP8GgE8u4DJxMzdQK hDtq1oYa6DpPDohUoUkmo1EdsmfaM/Y8wF7XrkxzbgNF0aqLs92FmjzmXiddisUy ji7Fh6fLxKxkk09cg30xzFSUJ8n6GN8DaLeYTJvoeHrCxkfqsEeudlZ3xEzn9l2A AhfhOJcrby/eWyzDE1pT8nr9eu0hDGzTF/AVPzyYdN+DWHt2PD4Sx4ozOheFECnC Rkwi+9Pr6EA= =q8Ho -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce