HAProxy Vulnerability: IP Spoofing in QUIC Sessions
Summary
UBUNTU-CVE-2024-49214: QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. Affects haproxy versions 2.8.5-1ubuntu3 – 2.9.9-1ubuntu2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides high availability, load balancing, and proxying for TCP and HTTP-based applications. It is known for its performance and reliability in managing web traffic. However, certain versions of HAProxy are vulnerable to an issue in the QUIC protocol that allows for the establishment of 0-RTT sessions with spoofed IP addresses, potentially bypassing security measures.
Vulnerability Detail
QUIC in HAProxy versions 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 contains a vulnerability that allows an attacker to open a 0-RTT session using a spoofed IP address. This can lead to unauthorized access and the ability to bypass IP allow/block lists, compromising the security of the application and its data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as stricter firewall rules or IP filtering to mitigate the risk of spoofed IP addresses until the patch is applied.
Conclusion
The HAProxy vulnerability related to IP spoofing in QUIC sessions poses a significant risk to applications relying on this software. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your systems.
See every vulnerability recorded for haproxy →
FAQ
HAProxy versions 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 are affected.
A 0-RTT session allows a client to send data to a server before the handshake is completed, which can improve performance but also introduces security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized access, allowing attackers to bypass security measures and potentially compromise sensitive data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
