Amazon Linux 2 Security Advisory: ALASHAPROXY2-2023-006
Advisory Release Date: 2023-08-21 21:01 Pacific
Advisory Updated Date: 2023-09-25 22:11 Pacific
Severity:
Important
Issue Overview:
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution. (CVE-2020-11100)
Affected Packages:
haproxy2
Note:
This advisory is applicable to Amazon Linux 2 - Haproxy2 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update haproxy2 to update your system.
New Packages:
aarch64:
haproxy2-2.1.4-1.amzn2.0.1.aarch64
haproxy2-debuginfo-2.1.4-1.amzn2.0.1.aarch64
src:
haproxy2-2.1.4-1.amzn2.0.1.src
x86_64:
haproxy2-2.1.4-1.amzn2.0.1.x86_64
haproxy2-debuginfo-2.1.4-1.amzn2.0.1.x86_64