HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service ...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
遠隔の未認証の攻撃者が、不完全なHTTP/2のPINGフレームを送ることで、ワーカースレッドのCPUを使い果たさせ、サービス拒否の状態を引き起こすおそれがあります。影響を受けるのはHAProxy 3.2・3.3・3.4系の修正前版、3.5-dev系の一部、HAProxy Enterprise Editionおよびkubernetes Ingress Controllerの一部版です。HAProxyは3.2.26、3.3.17、3.4.6、3.5-dev9で修正されているため、該当する版をお使いの場合は更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| HAProxy | HAProxy |
≥ 3.2.0, < 3.2.26 ≥ 3.3.0, < 3.3.17 ≥ 3.4.0, < 3.4.6 ≥ 3.5-dev, < 3.5-dev9 |
3.2.26 3.3.17 3.4.6 3.5-dev9 |
| HAProxy | HAProxy Enterprise Edition |
≥ 3.2.0r1, < 3.2r1-378.1259 ≥ 3.3.0r1, < 3.3r1-377.1005 |
3.2r1-378.1259 3.3r1-377.1005 |
| HAProxy | Kubernetes Ingress Controller |
≥ 3.2.0, < 3.2.17 |
3.2.17 |
| Haproxy | Kubernetes Ingress Controller Enterprise |
≥ 3.2.0, < 3.2.17-ee1 ≥ 3.0, < 3.0.16-ee17 ≥ 1.11, < 1.11.14-ee11 |
3.2.17-ee1 3.0.16-ee17 1.11.14-ee11 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
Références
- REDHAT Red Hat
- web cve@mitre.org
- web nvd.nist.gov
- web github.com