Most recent entries from all

ALSA-2023:6496 — Moderate: haproxy security and bug fix update

Affected: AlmaLinux:9: haproxy

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

* haproxy: data leak via fcgi requests (CVE-2023-0836)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-04833

BIT-haproxy-2023-0836

Affected: Bitnami: haproxy

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

EUVD-2026-217921

fkie_cve-2023-0836

GHSA-xhfw-qhxr-hjhq

gsd-2023-0836

OESA-2023-1886 — haproxy security update

Affected: openEuler:20.03-LTS-SP1: haproxy, openEuler:20.03-LTS-SP3: haproxy, openEuler:22.03-LTS: haproxy

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fix(es): An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836) HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)

RHSA-2023:6496 — Red Hat Security Advisory: haproxy security and bug fix update

haproxy: data leak via fcgi requests

UBUNTU-CVE-2023-0836

Affected: Ubuntu:22.04:LTS: haproxy

WID-SEC-W-2023-0716 — HAProxy Enterprise: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HAProxy Enterprise ausnutzen, um Informationen offenzulegen.