Red Hat Security Advisory: haproxy security update

Fixed packages 3

Vulnerabilities 2

• Critical 9.1
  CVE-2023-25725 Public exploit

  HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situati…

  haproxy haproxy haproxy Debian Ubuntu Azure Linux
  Feb 14, 2023
• Medium 6.5
  CVE-2023-0056

  An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue …

  haproxy haproxy haproxy-3.2 haproxy-3.3 Debian Ubuntu Wolfi
  Mar 23, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2160808
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2169089
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1696.json
• report
  https://access.redhat.com/security/cve/CVE-2023-0056
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0056
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0056
• article
  https://github.com/haproxy/haproxy/issues/1972
• report
  https://access.redhat.com/security/cve/CVE-2023-25725
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25725
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25725
• article
  https://www.haproxy.com/blog/february-2023-header-parser-fixed/
• article
  https://www.mail-archive.com/haproxy@formilux.org/msg43229.html