Red Hat Security AdvisoryRHSA-2024:1142
haproxy security update
Released 2024-03-05 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) haproxy-2.4.22-3.el9_3
Fixes 2 records
Priority HIGH 71
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110…
CVSS 3.1HIGH 7.2· Network · No auth · No interaction · EPSS 0.02147 · Published 2023-08-10 · Partial fix CWE-444
Priority MEDIUM 45
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.01514 · Published 2023-11-28 · Partial fix CWE-116
