CVE-2023-40225
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x...
Original description
The description as published by the source.
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.
Affected packages
Bitnami
haproxy
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.33"},{"introduced":"2.2.0"},{"fixed":"2.2.31"},{"introduced":"2.4.0"},{"fixed":"2.4.24"},{"introduced":"2.5.0"},{"fixed":"2.6.15"},{"introduced":"2.7.0"},{"fixed":"2.7.10"},{"introduced":"2.8.0"},{"fixed":"2.8.2"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-40225 haproxy Fixed in: 2.2.9-2+deb11u6
References
- advisory github.com
- patch github.com
- web cwe.mitre.org
- web haproxy.org
- web haproxy.org
- web haproxy.org
- web nvd.nist.gov