CVE-2023-40225
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.
Paquets affectés
Bitnami
haproxy
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.33"},{"introduced":"2.2.0"},{"fixed":"2.2.31"},{"introduced":"2.4.0"},{"fixed":"2.4.24"},{"introduced":"2.5.0"},{"fixed":"2.6.15"},{"introduced":"2.7.0"},{"fixed":"2.7.10"},{"introduced":"2.8.0"},{"fixed":"2.8.2"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-40225 haproxy Corrigé dans: 2.2.9-2+deb11u6
Références
- advisory github.com
- patch github.com
- web cwe.mitre.org
- web haproxy.org
- web haproxy.org
- web haproxy.org
- web nvd.nist.gov