Summary
It was discovered that HAProxy incorrectly handled URI components
containing the hash character (#). A remote attacker could possibly use
this issue to obtain sensitive information, or to bypass certain path_end
rules.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | haproxy | 2.0.31-0ubuntu0.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | haproxy | 2.4.22-0ubuntu0.22.04.3 |
Vulnerabilities 1
-
High 8.2CVE-2023-45539 Public exploit
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive inf…
References
-
report
https://ubuntu.com/security/CVE-2023-45539