CVE-2024-49214
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.
| Vendor | n/a |
| Product | n/a |
| Published | Oct 14, 2024 |
| Last Updated | Oct 29, 2024 |
Stay Ahead of the Next One
Get instant alerts for n/a n/a
Be the first to know when new medium vulnerabilities affecting n/a n/a are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
n/a / n/a
n/a
References
haproxy.org: https://www.haproxy.org/download/3.1/src/CHANGELOG github.com: https://github.com/haproxy/haproxy/commit/f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46 mail-archive.com: https://www.mail-archive.com/haproxy%40formilux.org/msg45291.html mail-archive.com: https://www.mail-archive.com/haproxy%40formilux.org/msg45314.html mail-archive.com: https://www.mail-archive.com/haproxy%40formilux.org/msg45315.html haproxy.org: https://www.haproxy.org/download/3.0/src/CHANGELOG haproxy.org: https://www.haproxy.org/download/2.9/src/CHANGELOG