Red Hat Security Advisory

RHSA-2023:1696

haproxy security update

Released 2023-04-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) haproxy-2.4.17-3.el9_1.2

Fixes 2 records

TI-2023-10998 CVE-2023-25725 · GHSA-h2p2-w857-329f

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are…

MEDIUM 54

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names,…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05493 Published 2023-02-14 Partial fix CWE-444

TI-2023-00052 CVE-2023-0056 · GHSA-43q4-pf55-3xhc

Uncontrolled resource consumption in haproxy

LOW 33

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01834 Published 2023-03-23 Partial fix CWE-400