Medium ELSA-2023-1696 2 CVEs

Moderate: haproxy security update (Oracle Linux 9)

Published Apr 11, 2023 · Updated Apr 11, 2023

Ecosystem: Oracle Linux

Summary

[2.4.17-3.2]
- Reject empty http header field names (CVE-2023-25725, #2174174)

[2.4.17-3.1]
- Refuse interim responses with end-stream flag set (CVE-2023-0056, #2174172)

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 9	haproxy	0:2.4.17-3.el9_1.2

Vulnerabilities 2

Critical 9.1

CVE-2023-25725 Public exploit

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situati…

haproxy haproxy haproxy Debian Ubuntu Azure Linux

Feb 14, 2023
Medium 6.5

CVE-2023-0056

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue …

haproxy haproxy haproxy-3.2 haproxy-3.3 Debian Ubuntu Wolfi

Mar 23, 2023