Описание
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while parsing an HTTP request. The highest threat from this vulnerability is integrity.
Меры по смягчению последствий
To mitigate this problem the following can be added to proxy config: http-request deny if { req.hdr_cnt(content-length) gt 1 } http-response deny if { res.hdr_cnt(content-length) gt 1 }
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | haproxy | Not affected | ||
| Red Hat Enterprise Linux 7 | haproxy | Not affected | ||
| Red Hat Enterprise Linux 8 | haproxy | Not affected | ||
| Red Hat Enterprise Linux 9 | haproxy | Not affected | ||
| Red Hat OpenShift Container Platform 3.11 | haproxy | Out of support scope | ||
| Red Hat Software Collections | rh-haproxy18-haproxy | Not affected | ||
| Red Hat OpenShift Container Platform 4.6 | haproxy | Fixed | RHSA-2022:0024 | 12.01.2022 |
| Red Hat OpenShift Container Platform 4.7 | haproxy | Fixed | RHSA-2022:0114 | 19.01.2022 |
| Red Hat OpenShift Container Platform 4.8 | haproxy | Fixed | RHSA-2021:5208 | 05.01.2022 |
| Red Hat OpenShift Container Platform 4.9 | haproxy | Fixed | RHSA-2021:4118 | 10.11.2021 |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_heade ...
7.5 High
CVSS3