CVE-2023-45539

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified ot...

Original description

The description as published by the source.

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami haproxy

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.2"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-45539 haproxy Fixed in: 2.2.9-2+deb11u6

References

web git.haproxy.org
web lists.debian.org
web lists.w3.org
web mail-archive.com
web nvd.nist.gov