Debian Bug report logs -
#704611
haproxy: CVE-2013-1912: crash on TCP content inspection rules
Reported by: Salvatore Bonaccorso <carnil@debian.org>
Date: Wed, 3 Apr 2013 14:54:02 UTC
Severity: important
Tags: patch, security, upstream
Fixed in versions haproxy/1.4.23-1, haproxy/1.4.8-1+squeeze1
Done: Vincent Bernat <bernat@debian.org>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Christo Buschek <crito@30loops.net>
:
Bug#704611
; Package src:haproxy
.
(Wed, 03 Apr 2013 14:54:08 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>
:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Christo Buschek <crito@30loops.net>
.
(Wed, 03 Apr 2013 14:54:08 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: haproxy
Severity: important
Tags: security upstream
Hi,
the following vulnerability was published for haproxy.
CVE-2013-1912[0]:
crash on TCP content inspection rules
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1912
http://security-tracker.debian.org/tracker/CVE-2013-1912
[1] http://git.1wt.eu/web?p=haproxy-1.4.git;a=commitdiff;h=dc80672211
[2] http://marc.info/?l=oss-security&m=136495389819925&w=2
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
Added tag(s) patch.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to 674447-submit@bugs.debian.org
.
(Fri, 05 Apr 2013 13:57:10 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Christo Buschek <crito@30loops.net>
:
Bug#704611
; Package src:haproxy
.
(Fri, 05 Apr 2013 13:57:14 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>
:
Extra info received and forwarded to list. Copy sent to Christo Buschek <crito@30loops.net>
.
(Fri, 05 Apr 2013 13:57:14 GMT) (full text, mbox, link).
Message #12 received at 704611@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Control: tags 674447 + patch
Control: tags 704611 + patch
Attached is a possible debdiff for these two (but not yet tested).
TODO remain:
- is #674447 considered to be RC or should we downgrade ad it needs a
extra tuning of tune.bufsize
- In case of an upload, will the Release Team also accept a patch for
#704611, else it should be removed again.
Regards,
Salvatore
[haproxy_1.4.15-1.1.debdiff (text/plain, attachment)]
Added tag(s) pending.
Request was from Anibal Monsalve Salazar <anibal@debian.org>
to control@bugs.debian.org
.
(Mon, 06 May 2013 20:09:14 GMT) (full text, mbox, link).
Reply sent
to Vincent Bernat <bernat@debian.org>
:
You have taken responsibility.
(Fri, 10 May 2013 15:03:55 GMT) (full text, mbox, link).
Notification sent
to Salvatore Bonaccorso <carnil@debian.org>
:
Bug acknowledged by developer.
(Fri, 10 May 2013 15:03:55 GMT) (full text, mbox, link).
Message #19 received at 704611-close@bugs.debian.org (full text, mbox, reply):
Source: haproxy
Source-Version: 1.4.23-1
We believe that the bug you reported is fixed in the latest version of
haproxy, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 704611@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Vincent Bernat <bernat@debian.org> (supplier of updated haproxy package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 06 May 2013 20:02:14 +0200
Source: haproxy
Binary: haproxy vim-haproxy
Architecture: source amd64 all
Version: 1.4.23-1
Distribution: unstable
Urgency: low
Maintainer: Debian HAProxy Maintainers <pkg-haproxy-maintainers@lists.alioth.debian.org>
Changed-By: Vincent Bernat <bernat@debian.org>
Description:
haproxy - fast and reliable load balancing reverse proxy
vim-haproxy - syntax highlighting for HAProxy configuration files
Closes: 641762 643650 649085 674447 678953 702893 704611 706890
Changes:
haproxy (1.4.23-1) unstable; urgency=low
.
[ Apollon Oikonomopoulos ]
* New upstream version (Closes: #643650, #678953)
+ This fixes CVE-2012-2942 (Closes: #674447)
+ This fixes CVE-2013-1912 (Closes: #704611)
* Ship vim addon as vim-haproxy (Closes: #702893)
* Check for the configuration file after sourcing /etc/default/haproxy
(Closes: #641762)
* Use /dev/log for logging by default (Closes: #649085)
.
[ Vincent Bernat ]
* debian/control:
+ add Vcs-* fields
+ switch maintenance to Debian HAProxy team. (Closes: #706890)
+ drop dependency to quilt: 3.0 (quilt) format is in use.
* debian/rules:
+ don't explicitly call dh_installchangelog.
+ use dh_installdirs to install directories.
+ use dh_install to install error and configuration files.
+ switch to `linux2628` Makefile target for Linux.
* debian/postrm:
+ remove haproxy user and group on purge.
* Ship a more minimal haproxy.cfg file: no `listen` blocks but `global`
and `defaults` block with appropriate configuration to use chroot and
logging in the expected way.
.
[ Prach Pongpanich ]
* debian/copyright:
+ add missing copyright holders
+ update years of copyright
* debian/rules:
+ build with -Wl,--as-needed to get rid of unnecessary depends
* Remove useless files in debian/haproxy.{docs,examples}
* Update debian/watch file, thanks to Bart Martens
Checksums-Sha1:
f398a8443724f3c6896237fb3b76dc93d66a47f9 2059 haproxy_1.4.23-1.dsc
841c6d0f9ad3fcbc7b01c17e40edc980853790f4 835938 haproxy_1.4.23.orig.tar.gz
6b8e87da4539b611f29de0570f37838183bd2010 9245 haproxy_1.4.23-1.debian.tar.gz
35034c465055b451632d5424a8e9fecf795bcdfb 417024 haproxy_1.4.23-1_amd64.deb
ccae0ca7b65097044054fc2585091895a3c2d85d 50018 vim-haproxy_1.4.23-1_all.deb
Checksums-Sha256:
cae90ad3fb7f2e0847b38822c94935ec0495200fb9001380e77e2e8e5b579e28 2059 haproxy_1.4.23-1.dsc
8d0676027a0eca9d1eb8409977ae916fe94913fbbcaf7c278021cc21d897ee6d 835938 haproxy_1.4.23.orig.tar.gz
745697404c2c5ed82fa5065da79deead850917bd399005e0167d1a07b16bc3a1 9245 haproxy_1.4.23-1.debian.tar.gz
a69b2f7dc09bb9207882d42b332e4e3577be71b1c2605fc417402227165049ac 417024 haproxy_1.4.23-1_amd64.deb
eb4a5dbc00ecf8ff1e4f733cf4618df9d638be6ea244e0d063fede3279d5b52d 50018 vim-haproxy_1.4.23-1_all.deb
Files:
cf8b6676bd27d1c65ee633a4d65e6ecf 2059 net optional haproxy_1.4.23-1.dsc
5803664782f8f1692ccbbd03555061f1 835938 net optional haproxy_1.4.23.orig.tar.gz
3f5d5dd4463792e585bc1d493574f41e 9245 net optional haproxy_1.4.23-1.debian.tar.gz
17e1d62b7c1107b1917a2636578c01c9 417024 net optional haproxy_1.4.23-1_amd64.deb
94e059c7a6af20461f6693500a4ea987 50018 net optional vim-haproxy_1.4.23-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCAAGBQJRh/NaAAoJEJWkL+g1NSX5o8QP/inbDHXysUDT5McNBbKjvgVK
/pUUF1yU08ra2dOPHHKWBzdS2WwnZiULuuIsOrE7NRiyLCNUqnhL8rSQmVwlI0I+
vmi9yXmO21FfMxV0O8mOqxLZk4gIR1zDSGviT2AIjg/kIsHsH2gryG1KPvriCIzV
DcVLzW+x7lI+zm71GGC+QbbcaHzpzoU8YTckPoHx8zcCcOsr4Q4gFzK1MIRucCdj
109pFTu/nQYtTYRL/zM4pnd26ENDQaOjC0+NSPeVIEn5BMbXr6TDvK5Kdd5jWEYZ
7MPE6b2/49DWVBC2lbqu/zuqfNjiy6PkSx2j3EVEkw3U9kqO8cwIG5pYUvrmDgOo
IVmhdcQ2weZIsS9nws/I+DT3uiIe5ezo0tmTXE3wuD/zqHMWHRe2b+++1DTs+jyj
Ky5XaSQLd7+T4Te2JRCheWBR1OB+8er+Tk4ffY3233vy2ToMAGy5dn5zEYzKw+bo
XJWzHzKvrt6URU4Qyfvz7uMckJvqnvFAnaxtZEREbqRkHlAeCoxxucQDpR8zyAnf
p0Wt6roDJfY0V/XaKX38RI/4P+DorRi5AQzjmKzfC9b5vLuiy9aqIE9c68cCokuW
3mmGe1LlDV1KL9bwqtqTAN8Mv4IJMJBEmEexI6KbLTIlr3w2I9JfABrvDTSpgQGh
JUI3ggs8XjbOGKAiS5bB
=Yd7g
-----END PGP SIGNATURE-----
Reply sent
to Vincent Bernat <bernat@debian.org>
:
You have taken responsibility.
(Thu, 20 Jun 2013 22:21:08 GMT) (full text, mbox, link).
Notification sent
to Salvatore Bonaccorso <carnil@debian.org>
:
Bug acknowledged by developer.
(Thu, 20 Jun 2013 22:21:08 GMT) (full text, mbox, link).
Message #24 received at 704611-close@bugs.debian.org (full text, mbox, reply):
Source: haproxy
Source-Version: 1.4.8-1+squeeze1
We believe that the bug you reported is fixed in the latest version of
haproxy, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 704611@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Vincent Bernat <bernat@debian.org> (supplier of updated haproxy package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sat, 15 Jun 2013 11:27:32 +0200
Source: haproxy
Binary: haproxy
Architecture: source i386
Version: 1.4.8-1+squeeze1
Distribution: squeeze-security
Urgency: high
Maintainer: Arnaud Cornet <acornet@debian.org>
Changed-By: Vincent Bernat <bernat@debian.org>
Description:
haproxy - fast and reliable load balancing reverse proxy
Closes: 674447 704611
Changes:
haproxy (1.4.8-1+squeeze1) squeeze-security; urgency=high
.
* CVE-2013-1912: buffer overflow when HTTP keep-alive is enabled, using
HTTP keywords in TCP inspection rules and running with rewrite rules
that appends to requests. Closes: #704611.
* CVE-2012-2942: buffer overflow in the trash buffer in the header
capture functionality when global.tune.bufsize is set to a value
greater than the default and header rewriting is enabled.
Closes: #674447.
* CVE-2013-2175: fix a possible crash when using negative header
occurrences.
Checksums-Sha1:
53032a347ad5f0a338049f78a16dc0cc24d43b17 1721 haproxy_1.4.8-1+squeeze1.dsc
3b7a982ba7fb01d43826f5af5e95c86080ae0ca3 778220 haproxy_1.4.8.orig.tar.gz
33901a1e9b0051e249bc2b3f9890049523b934df 13650 haproxy_1.4.8-1+squeeze1.debian.tar.gz
611331a56b857041db0a636e0c0d1c7e3bfbbeef 506684 haproxy_1.4.8-1+squeeze1_i386.deb
Checksums-Sha256:
d9f08e7c388be0accc6ded7b3bc4b4b4e6f0a1fd9d62345fceb24921f2d46076 1721 haproxy_1.4.8-1+squeeze1.dsc
707487ade815cbd37492d91a014f9a5b3ac313e5b4cb31e2d7c4d2a16f4a23f1 778220 haproxy_1.4.8.orig.tar.gz
f403577021ce7d845805965f31eb94d343043228322007511b4fbd3f6fd0047c 13650 haproxy_1.4.8-1+squeeze1.debian.tar.gz
a00401a5f7f8dc499ba806f4144af654c07eab6ed0c418903df24497697ed991 506684 haproxy_1.4.8-1+squeeze1_i386.deb
Files:
97a0b0a035cbf453ca95d0b45c5ac253 1721 net optional haproxy_1.4.8-1+squeeze1.dsc
104f4985b37bd9bac7a33e20fb6aaadf 778220 net optional haproxy_1.4.8.orig.tar.gz
0e1878cbfd1b0bdff1451304af14b1d8 13650 net optional haproxy_1.4.8-1+squeeze1.debian.tar.gz
d470c9a1614ca45e9436769db85e2241 506684 net optional haproxy_1.4.8-1+squeeze1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCAAGBQJRv2jOAAoJEJWkL+g1NSX5sxcP/jX2FWvajqLyrDy4kCTetvey
pY8uPLCQ2viZWuDaj7aCQhgbFJ0/0e+WDkJ8+jZMpCzaHUzSYs3EXthaWu1Jl4B1
rOFNnAy+fC+Gld2liyU03MUhQzQ10iM71zuTMKoei2kXHwzx5IxCz/x+chyKjeCS
5FsaEibFWtB82AXcF/8OUM2f9ZKbcLe7QVkcb8K7N1x7YN1DT/h4OEbNMH3TNj1k
OofQly8I5Sftees+zTtT0cMEgrHi/i9LRX3wsXA3XylBLsS4cvIjfWMJLmNb+ZJO
vGdGez+2Uz5halSl15xDC6XnPz86nc2dgP6/5ghw0fdyUtH+wOS6PwmKYlGRgzKP
W9ANXe2i2rqLQ22Uq9upPViFqlBchsd1qJv3vycqlPu85ROqpmBPes2sqbDrSkwu
dJ1J3rQECyEpOxPjVwCm1xNMzt1HfKaRvLr880JPa6FeCDLrzlmAjRKZEg3WHw0L
dZBFjEXyB5NH9yadty7P4rEEG0Z0j0JfTU67qqwWNE4tYWID3l5LuTjDjUOf8ZuA
234Y4/CnP/O4VTvsO4hASif/ha80Q1w8OYxI/XbvABgwDdIU2lcmRzcvjY3LY4mt
5NJ2eV/fA6fdCt6JKrc5/BnsasqjBjAQrvAzfdKc/skV98k6WDUUeG5+/ESYj3bV
SbOImYCmDR4acq/joYvI
=vVaG
-----END PGP SIGNATURE-----
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org
.
(Fri, 19 Jul 2013 07:26:33 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 18:37:50 2019;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.