Summary
Bahruz Jabiyev, Anthony Gavazzi, Engin Kirda, Kaan Onarlioglu, Adi Peleg,
and Harvey Tuch discovered that HAProxy incorrectly handled empty header
names. A remote attacker could possibly use this issue to manipulate
headers and bypass certain authentication checks and restrictions.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | haproxy | 1.8.8-1ubuntu0.13 |
| Ubuntu · 20.04 LTS 20.04:LTS | haproxy | 2.0.29-0ubuntu1.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | haproxy | 2.4.18-0ubuntu1.2 |
Vulnerabilities 1
-
Critical 9.1CVE-2023-25725 Public exploit
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situati…
References
-
report
https://ubuntu.com/security/CVE-2023-25725