Summary
Bahruz Jabiyev, Anthony Gavazzi, Engin Kirda, Kaan Onarlioglu, Adi Peleg,
and Harvey Tuch discovered that HAProxy incorrectly handled empty header
names. A remote attacker could possibly use this issue to manipulate
headers and bypass certain authentication checks and restrictions.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | haproxy | 1.6.3-1ubuntu0.3+esm2 |
Vulnerabilities 1
-
Critical 9.1CVE-2023-25725 Public exploit
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situati…
References
-
report
https://ubuntu.com/security/CVE-2023-25725