Summary
Seth Manesse and Paul Plasil discovered that HAProxy incorrectly handled
URI components containing the hash character (#). A remote attacker could
possibly use this issue to obtain sensitive information, or to bypass
certain path_end rules.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | haproxy | 1.6.3-1ubuntu0.3+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | haproxy | 1.8.8-1ubuntu0.13+esm2 |
Vulnerabilities 1
-
High 8.2CVE-2023-45539 Public exploit
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive inf…
References
-
report
https://ubuntu.com/security/CVE-2023-45539