HAProxy Vulnerability: Denial of Service and Arbitrary Code Execution Risk
Summary
USN-7431-1: haproxy vulnerability. Affects haproxy versions < 2.4.24-0ubuntu0.22.04.2. Fixed in 2.4.24-0ubuntu0.22.04.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
HAProxy is a widely-used open-source software that provides high availability, load balancing, and proxying for TCP and HTTP-based applications. It is known for its performance and reliability in managing large volumes of traffic. However, recent vulnerabilities have been identified that could compromise its stability and security, particularly in uncommon configurations.
Vulnerability Detail
Aleandro Prudenzano and Edoardo Geraci discovered that HAProxy incorrectly handled certain uncommon configurations that replace multiple short patterns with a longer one. This flaw allows a remote attacker to exploit the issue, potentially causing HAProxy to crash, leading to a denial of service. In some cases, it may also allow the execution of arbitrary code, posing a significant security risk.
How To Fix
Minimum fixed version
2.4.24-0ubuntu0.22.04.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the use of uncommon configurations that may trigger this vulnerability. Review your HAProxy configuration files and avoid replacing multiple short patterns with longer ones until the package can be updated.
Conclusion
The identified vulnerability in HAProxy poses significant risks, including denial of service and potential arbitrary code execution. It is crucial for users to update to the latest patched versions to mitigate these risks. Additionally, reviewing configurations and utilizing tools like Vulert can help maintain security in open-source applications.
See every vulnerability recorded for haproxy →
FAQ
HAProxy is an open-source software that provides load balancing and proxying for TCP and HTTP applications, ensuring high availability and reliability.
The vulnerability can lead to denial of service or arbitrary code execution, allowing attackers to disrupt service or gain unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, avoid using uncommon configurations that could trigger the vulnerability until you can apply the necessary updates.
Detailed information can be found in the Ubuntu Security Notices, specifically USN-7431-1, which outlines the vulnerability and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
