Описание
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 1.8.8-1ubuntu0.7 |
| devel | not-affected | 2.0.8-1 |
| disco | released | 1.8.19-1ubuntu1.2 |
| eoan | released | 2.0.5-1ubuntu0.2 |
| esm-infra-legacy/trusty | DNE | |
| esm-infra/bionic | released | 1.8.8-1ubuntu0.7 |
| esm-infra/xenial | released | 1.6.3-1ubuntu0.3 |
| precise/esm | DNE | |
| trusty | ignored | end of standard support |
| trusty/esm | DNE |
Показывать по
4.3 Medium
CVSS2
7.5 High
CVSS3
Связанные уязвимости
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).
A flaw was found in HAProxy before 2.0.6. In legacy mode, messages fea ...
4.3 Medium
CVSS2
7.5 High
CVSS3