9.1
CVSSv3

CVE-2023-25725

Published: 14/02/2023 Updated: 07/11/2023
CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9
VMScore: 0

Vulnerability Summary

HAProxy prior to 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

haproxy haproxy

debian debian linux 10.0

debian debian linux 11.0

Vendor Advisories

Two vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which may result in denial of service, or bypass of access controls and routing rules via specially crafted requests For the stable distribution (bullseye), these problems have been fixed in version 229-2+deb11u4 We recommend that you upgrade your ...
HAProxy before 273 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling" The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed fo ...
Synopsis Moderate: haproxy security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for haproxy is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having a se ...
Synopsis Moderate: OpenShift Container Platform 4130 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4130 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...
Synopsis Moderate: OpenShift Container Platform 4128 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 4128 is now available with updates to packages and image ...
Synopsis Critical: Multicluster Engine for Kubernetes 224 security fixes and container updates Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 224 General Availability release images, which fix security issues and update container imagesRed Hat Product Security has rated this update as having a security ...
Synopsis Important: OpenShift Container Platform 4128 security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4128 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Pla ...
Synopsis Important: new container image: rhceph-53 Type/Severity Security Advisory: Important Topic Updated container image for Red Hat Ceph Storage 53 is now available inthe Red Hat Ecosystem CatalogRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base sc ...
Synopsis Moderate: haproxy security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for haproxy is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security has rated ...
Synopsis Important: OpenShift Container Platform 41132 security and extras update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41132 is now available with updates to packages and images that fix several bugsThis release includes a security update for Red Hat OpenShift Container Platform 4 ...
Synopsis Important: OpenShift Container Platform 4130 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 4130 is now available with updates to packages and ima ...