Vulnerability · Published Feb 14, 2023 · Assigned by mitre
CVE-2023-25725
Critical 9.1
In plain English
A critical-severity security flaw in the haproxy package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.5% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | haproxy | 2.4.17-3.el9_1.2 | ALSA-2023:1696 |
| Debian:12 | haproxy | 2.6.8-2 | DEBIAN-CVE-2023-25725 |
| Debian:13 | haproxy | 2.6.8-2 | DEBIAN-CVE-2023-25725 |
| Debian:14 | haproxy | 2.6.8-2 | DEBIAN-CVE-2023-25725 |
| Ubuntu:22.04:LTS | haproxy | 2.4.18-0ubuntu1.2 | USN-5869-1 |
| Ubuntu:22.04:LTS | haproxy | 2.4.18-0ubuntu1.2 | UBUNTU-CVE-2023-25725 |
Affected products (as reported)
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- https://www.haproxy.org/
- https://git.haproxy.org/?p=haproxy-2.7.git%3Ba=commit%3Bh=a0e561ad7f29ed50c473f5a9da664267b60d1112
- [debian-lts-announce] 20230214 [SECURITY] [DLA 3318-1] haproxy security update mailing-list
- DSA-5348 vendor-advisory
- FEDORA-2023-7e04833463 vendor-advisory
- FEDORA-2023-3e8a21cd5b vendor-advisory