Most recent entries from all

ALSA-2023:1696 — Moderate: haproxy security update

Affected: AlmaLinux:9: haproxy

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

* haproxy: segfault DoS (CVE-2023-0056) * haproxy: request smuggling attack in HTTP/1 header parsing (CVE-2023-25725)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-04835

EUVD-2026-219025

fkie_cve-2023-0056

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

GHSA-43q4-pf55-3xhc

gsd-2023-0056

OESA-2023-1141 — haproxy security update

Affected: openEuler:20.03-LTS-SP1: haproxy, openEuler:20.03-LTS-SP3: haproxy, openEuler:22.03-LTS: haproxy, openEuler:22.03-LTS-SP1: haproxy

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fix(es): Initial description: Router PODs frequently getting restarted and haproxy process is receiving the segfault but it is not generating coredump even though the core file size is unlimited. Upstream bug: https://github.com/haproxy/haproxy/issues/1972(CVE-2023-0056) HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.(CVE-2023-25725)

RHBA-2023:0773 — Red Hat Bug Fix Advisory: OpenShift Container Platform 4.11.28 packages update

haproxy: segfault DoS

RHSA-2023:1696 — Red Hat Security Advisory: haproxy security update

haproxy: segfault DoS haproxy: request smuggling attack in HTTP/1 header parsing

SUSE-FU-2023:2117-1 — Feature update for haproxy

Feature update for haproxy

UBUNTU-CVE-2023-0056

Affected: Ubuntu:20.04:LTS: haproxy, Ubuntu:22.04:LTS: haproxy

WID-SEC-W-2023-0097 — HAProxy: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HAProxy ausnutzen, um einen Denial of Service Angriff durchzuführen.