Vulnerability · Published Nov 28, 2023 · Assigned by mitre
CVE-2023-45539
High 8.2
In plain English
A high-severity security flaw in the haproxy package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | haproxy | 1.8.27-5.el8_10.1 | ALSA-2024:8849 |
| AlmaLinux:9 | haproxy | 2.4.22-3.el9_3 | ALSA-2024:1142 |
| Debian:12 | haproxy | 2.6.12-1+deb12u1 | DEBIAN-CVE-2023-45539 |
| Debian:12 | haproxy | 2.6.12-1+deb12u1 | DSA-5590-1 |
| Debian:13 | haproxy | 2.6.15-1 | DEBIAN-CVE-2023-45539 |
| Debian:14 | haproxy | 2.6.15-1 | DEBIAN-CVE-2023-45539 |
| Rocky Linux:8 | haproxy | 0:1.8.27-5.el8_10.1 | RLSA-2024:8849 |
| Ubuntu:22.04:LTS | haproxy | 2.4.22-0ubuntu0.22.04.3 | UBUNTU-CVE-2023-45539 |
| Ubuntu:22.04:LTS | haproxy | 2.4.22-0ubuntu0.22.04.3 | USN-6530-1 |
Affected products (as reported)
Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- https://lists.w3.org/Archives/Public/ietf-http-wg/2023JulSep/0070.html
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=2eab6d354322932cfec2ed54de261e4347eca9a6
- https://www.mail-archive.com/haproxy%40formilux.org/msg43861.html
- [debian-lts-announce] 20231214 [SECURITY] [DLA 3688-1] haproxy security update mailing-list