CVE-2018-20102 vulnerability in HAProxy and Other Products
Published on December 12, 2018
An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything that was left on the stack, or even past the end of the 8193-byte buffer, depending on the value of accepted_payload_size.
Products Associated with CVE-2018-20102
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-20102 are published in these products:
Exploit Probability
EPSS
0.03%
Percentile
9.12%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.