Most recent entries from all

ALSA-2024:1142 — Moderate: haproxy security update

Affected: AlmaLinux:9: haproxy

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

* haproxy: Proxy forwards malformed empty Content-Length headers (CVE-2023-40225) * haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers (CVE-2023-45539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-02423

BIT-haproxy-2023-45539

Affected: Bitnami: haproxy

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

EUVD-2026-195622

fkie_cve-2023-45539

GHSA-79q7-m98p-qvhp

gsd-2023-45539

msrc_CVE-2023-45539 — HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive inf…

msrc_CVE-2023-45539

OESA-2023-1886 — haproxy security update

Affected: openEuler:20.03-LTS-SP1: haproxy, openEuler:20.03-LTS-SP3: haproxy, openEuler:22.03-LTS: haproxy

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fix(es): An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.(CVE-2023-0836) HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.(CVE-2023-45539)

RHSA-2024:10267 — Red Hat Security Advisory: haproxy security update

haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers

RHSA-2024:1142 — Red Hat Security Advisory: haproxy security update

haproxy: Proxy forwards malformed empty Content-Length headers haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers

SUSE-SU-2023:4645-1 — Security update for haproxy

Security update for haproxy

UBUNTU-CVE-2023-45539

Affected: Ubuntu:Pro:16.04:LTS: haproxy, Ubuntu:Pro:18.04:LTS: haproxy, Ubuntu:20.04:LTS: haproxy, Ubuntu:22.04:LTS: haproxy

WID-SEC-W-2023-3019 — HAProxy Enterprise: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HAProxy Enterprise ausnutzen, um Informationen offenzulegen.