CVE-2018-20103
haproxy: An issue was discovered in dns.c in HAProxy through 1.8.14
CVE-2018-20103 is fixed in 2 products on 1 platform, first by haproxy 1.8.8-1ubuntu0.3, released December 30, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0659
93rd percentile
An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| haproxy · Ubuntu 18.04.6 LTS (bionic) | 1.8.8-1ubuntu0.3 | haproxy 1.8.8-1ubuntu0.3 | Dec 30, 2018 |
| vim-haproxy · Ubuntu 18.04.6 LTS (bionic) | 1.8.8-1ubuntu0.3 | vim-haproxy 1.8.8-1ubuntu0.3 | Dec 30, 2018 |