Moderate: haproxy security update
Summary
ALSA-2023:1696: Moderate: haproxy security update. Affects haproxy versions < 2.4.17-3.el9_1.2. Fixed in 2.4.17-3.el9_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The haproxy package is a reliable and high-performance network load balancer designed for TCP and HTTP-based applications. It provides load balancing, high availability, and proxying functionalities. The package is widely used in various environments to distribute incoming network traffic across multiple servers, ensuring optimal performance and availability.
Vulnerability Detail
This security update addresses two vulnerabilities in haproxy:
-
CVE-2023-0056: This vulnerability can lead to a denial of service (DoS) attack, causing the haproxy service to crash. An attacker can exploit this flaw by sending specially crafted requests, triggering a segmentation fault and crashing the service.
-
CVE-2023-25725: This vulnerability allows for a request smuggling attack in the HTTP/1 header parsing of haproxy. By manipulating the headers of HTTP requests, an attacker can bypass security measures and potentially perform unauthorized actions or gain access to sensitive information.
How To Fix
Minimum fixed version
2.4.17-3.el9_1.2
This is the first release that contains the fix.
sudo dnf update haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the haproxy package is affected by two vulnerabilities: a DoS vulnerability and a request smuggling vulnerability. To mitigate these risks, it is crucial to update the haproxy package to the latest version. By following the provided steps, you can ensure that your haproxy installation is secure and protected against potential attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for haproxy →
FAQ
haproxy is a network load balancer used for TCP and HTTP-based applications. It provides load balancing, high availability, and proxying functionalities.
A denial of service (DoS) attack is an attempt to make a service or network resource unavailable to its intended users. In the case of haproxy, the DoS attack can crash the service, rendering it inaccessible.
A request smuggling attack is a technique where an attacker manipulates the headers of HTTP requests to bypass security measures or perform unauthorized actions. In the case of haproxy, this vulnerability allows for request smuggling in the HTTP/1 header parsing.
An attacker can exploit the DoS vulnerability by sending specially crafted requests that trigger a segmentation fault in haproxy, causing it to crash. The request smuggling vulnerability can be exploited by manipulating the headers of HTTP requests to bypass security measures and potentially gain unauthorized access or perform malicious actions.
Yes, a fix is available for these vulnerabilities. It is recommended to update the haproxy package to version 2.4.17-3.el9_1.2 or later to address these security issues.
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
