Denial of Service Vulnerability in HAProxy - CVE-2022-0711
Summary
ALPINE-CVE-2022-0711: A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. Affects haproxy versions < 2.2.21-r0. Fixed in 2.2.21-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides high availability, load balancing, and proxying for TCP and HTTP-based applications. It is known for its performance and reliability, making it a popular choice for managing web traffic. However, like any software, it can be susceptible to vulnerabilities that may compromise its functionality and the services it supports.
Vulnerability Detail
A flaw was identified in HAProxy's handling of HTTP responses containing the 'Set-Cookie2' header. This vulnerability allows an attacker to craft malicious HTTP response packets that can trigger an infinite loop within HAProxy. The result is a denial of service (DoS) condition, where legitimate users are unable to access the services managed by HAProxy. The vulnerability has a CVSS score of 7.5, indicating a high severity level, primarily affecting the availability of the service.
How To Fix
Minimum fixed version
2.2.21-r0
This is the first release that contains the fix.
sudo apk add --upgrade haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can configure HAProxy to ignore the 'Set-Cookie2' header in HTTP responses. However, this is not a permanent fix and should only be used until the software can be updated.
Conclusion
CVE-2022-0711 represents a significant vulnerability in HAProxy that can lead to service disruptions. It is crucial for users to update to the patched version to mitigate the risk of denial of service attacks. Regular monitoring and timely updates are essential for maintaining the security of software applications.
See every vulnerability recorded for haproxy →
FAQ
CVE-2022-0711 is a vulnerability in HAProxy that can lead to a denial of service due to improper handling of the 'Set-Cookie2' header in HTTP responses.
If you are running HAProxy versions prior to 2.2.21-r0, your installation is vulnerable to CVE-2022-0711.
The primary impact is a denial of service, which can prevent legitimate users from accessing services managed by HAProxy.
Yes, you can use Vulert to monitor your open-source dependencies for vulnerabilities in real-time without needing to access the code directly.
Detailed information can be found in the CVE database and through security advisories related to HAProxy.
References
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
