Описание
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.
Отчет
Red Hat Product Security has rated this issue as having a security impact of Moderate, and a future update may address this flaw.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | haproxy | Not affected | ||
| Red Hat Enterprise Linux 7 | haproxy | Not affected | ||
| Red Hat Enterprise Linux 8 | haproxy | Not affected | ||
| Red Hat OpenShift Enterprise 3 | haproxy | Not affected | ||
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-haproxy18-haproxy | Fixed | RHSA-2019:1436 | 11.06.2019 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | rh-haproxy18-haproxy | Fixed | RHSA-2019:1436 | 11.06.2019 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | rh-haproxy18-haproxy | Fixed | RHSA-2019:1436 | 11.06.2019 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-haproxy18-haproxy | Fixed | RHSA-2019:1436 | 11.06.2019 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.
Incorrect caching of responses to requests including an Authorization ...
Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.
Уязвимость функции check_request_for_cacheability серверного программного обеспечения HAProxy, позволяющая нарушителю раскрыть защищаемую информацию
EPSS
7.5 High
CVSS3