haproxy haproxy vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

HAProxy prior to 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include/types/ssl_sock.h error.

Haproxy Haproxy

5

CVSSv2

HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network.

Haproxy Haproxy -

5

CVSSv2

An integer overflow exists in HAProxy 2.0 up to and including 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an malicious user to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

Haproxy Haproxy Haproxy Haproxy 2.5 Debian Debian Linux 11.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34

7 Github repositories

4.3

CVSSv2

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 up to and including 1.8.9 (if cache enabled) allows malicious users to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for...

Haproxy Haproxy Canonical Ubuntu Linux 18.04

NA

HAProxy prior to 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTT...

Haproxy Haproxy Debian Debian Linux 10.0 Debian Debian Linux 11.0

5

CVSSv2

An issue exists in HAProxy 2.2 prior to 2.2.16, 2.3 prior to 2.3.13, and 2.4 prior to 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what...

Haproxy Haproxy Debian Debian Linux 11.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34

5

CVSSv2

An issue exists in HAProxy 2.0 prior to 2.0.24, 2.2 prior to 2.2.16, 2.3 prior to 2.3.13, and 2.4 prior to 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protecte...

Haproxy Haproxy Debian Debian Linux 11.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34

5

CVSSv2

An issue exists in HAProxy 2.2 prior to 2.2.16, 2.3 prior to 2.3.13, and 2.4 prior to 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled.

Haproxy Haproxy Debian Debian Linux 11.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34

4.3

CVSSv2

The HAProxy package prior to 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.

Netgate Haproxy

1 EDB exploit

5

CVSSv2

headerv2.go in mastercactapus proxyprotocol prior to 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin up to and including 0.0.2 for Caddy, allows remote malicious users to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 r...

Haproxy Proxyprotocol

Get Started

« PREV 1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook