CVE-2023-0056

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

Initial description: Router PODs frequently getting restarted and haproxy process is receiving the segfault but it is not generating coredump even though the core file size is unlimited.

Upstream bug: https://github.com/haproxy/haproxy/issues/1972(CVE-2023-0056)

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.(CVE-2023-25725)

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

• haproxy: segfault DoS (CVE-2023-0056)
• haproxy: request smuggling attack in HTTP/1 header parsing (CVE-2023-25725)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

This update for haproxy fixes the following issues:

Update to version 2.0.31 (jsc#PED-3821):

• BUG/CRITICAL: http: properly reject empty http header field names
• CI: github: don't warn on deprecated openssl functions on windows
• DOC: proxy-protocol: fix wrong byte in provided example
• DOC: config: 'http-send-name-header' option may be used in default section
• DOC: config: fix option spop-check proxy compatibility
• BUG/MEDIUM: cache: use the correct time reference when comparing dates
• BUG/MEDIUM: stick-table: do not leave entries in end of window during purge
• BUG/MEDIUM: ssl: wrong eviction from the session cache tree
• BUG/MINOR: http-ana: make set-status also update txn->status
• BUG/MINOR: http-fetch: Don't block HTTP sample fetch eval in HTTP_MSG_ERROR state
• BUG/MINOR: promex: Don't forget to consume the request on error
• BUG/MINOR: resolvers: Wait the resolution execution for a do_resolv action
• BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned
• BUILD: makefile: sort the features list
• BUILD: makefile: build the features list dynamically
• BUG/MINOR: pool/stats: Use ullong to report total pool usage in bytes in stats
• BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream flag set
• LICENSE: wurfl: clarify the dummy library license.
• BUG/MEDIUM: resolvers: Use tick_first() to update the resolvers task timeout
• BUG/MEDIUM: mworker: fix segv in early failure of mworker mode with peers
• BUG/MINOR: ssl: Fix potential overflow
• BUG/MEDIUM: ssl: Verify error codes can exceed 63
• CI: github: change 'ubuntu-latest' to 'ubuntu-20.04'
• SCRIPTS: announce-release: add a link to the data plane API
• [RELEASE] Released version 2.0.30
• Revert 'CI: determine actual LibreSSL version dynamically'
• DOC: config: clarify the -m dir and -m dom pattern matching methods
• DOC: config: clarify the fact that 'retries' is not just for connections
• DOC: config: explain how default matching method for ACL works
• DOC: config: clarify the fact that SNI should not be used in HTTP scenarios
• DOC: config: provide some configuration hints for 'http-reuse'
• BUILD: listener: fix build warning on global_listener_rwlock without threads
• BUILD: peers: Remove unused variables
• BUG/MEDIUM: peers: messages about unkown tables not correctly ignored
• BUG/MINOR: http_ana/txn: don't re-initialize txn and req var lists
• BUG/MEDIUM: listener: Fix race condition when updating the global mngmt task
• CI: emit the compiler's version in the build reports
• CI: add monthly gcc cross compile jobs
• BUG/MEDIUM: stick-table: fix a race condition when updating the expiration task
• BUG/MAJOR: stick-table: don't process store-response rules for applets
• DOC: management: add forgotten 'show startup-logs'
• CI: Replace the deprecated ::set-output command by writing to $GITHUB_OUTPUT in workflow definition
• CI: Replace the deprecated ::set-output command by writing to $GITHUB_OUTPUT in matrix.py
• BUG/MAJOR: stick-tables: do not try to index a server name for applets
• DOC: configuration: missing 'if' in tcp-request content example
• BUILD: http_fetch: silence an uninitiialized warning with gcc-4/5/6 at -Os
• BUG/MINOR: http-fetch: Update method after a prefetch in smp_fetch_meth()
• BUG/MEDIUM: lua: handle stick table implicit arguments right.
• BUILD: cfgparse: Fix GCC warning about a variable used after realloc
• BUILD: fix compilation for OpenSSL-3.0.0-alpha17
• BUG/MINOR: log: improper behavior when escaping log data
• SCRIPTS: announce-release: update some URLs to https
• BUG/MEDIUM: captures: free() an error capture out of the proxy lock
• BUG/MEDIUM: proxy: ensure pause_proxy() and resume_proxy() own PROXY_LOCK
• BUG/MINOR: signals/poller: ensure wakeup from signals
• BUG/MINOR: signals/poller: set the poller timeout to 0 when there are signals
• BUG/MINOR: h1: Support headers case adjustment for TCP proxies
• REGTESTS: http_request_buffer: Add a barrier to not mix up log messages
• BUG/MEDIUM: peers:…

This update for haproxy fixes the following issues:

Update to version 2.0.31 (jsc#PED-3821):

• BUG/CRITICAL: http: properly reject empty http header field names
• CI: github: don't warn on deprecated openssl functions on windows
• DOC: proxy-protocol: fix wrong byte in provided example
• DOC: config: 'http-send-name-header' option may be used in default section
• DOC: config: fix option spop-check proxy compatibility
• BUG/MEDIUM: cache: use the correct time reference when comparing dates
• BUG/MEDIUM: stick-table: do not leave entries in end of window during purge
• BUG/MEDIUM: ssl: wrong eviction from the session cache tree
• BUG/MINOR: http-ana: make set-status also update txn->status
• BUG/MINOR: http-fetch: Don't block HTTP sample fetch eval in HTTP_MSG_ERROR state
• BUG/MINOR: promex: Don't forget to consume the request on error
• BUG/MINOR: resolvers: Wait the resolution execution for a do_resolv action
• BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned
• BUILD: makefile: sort the features list
• BUILD: makefile: build the features list dynamically
• BUG/MINOR: pool/stats: Use ullong to report total pool usage in bytes in stats
• BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream flag set
• LICENSE: wurfl: clarify the dummy library license.
• BUG/MEDIUM: resolvers: Use tick_first() to update the resolvers task timeout
• BUG/MEDIUM: mworker: fix segv in early failure of mworker mode with peers
• BUG/MINOR: ssl: Fix potential overflow
• BUG/MEDIUM: ssl: Verify error codes can exceed 63
• CI: github: change 'ubuntu-latest' to 'ubuntu-20.04'
• SCRIPTS: announce-release: add a link to the data plane API
• [RELEASE] Released version 2.0.30
• Revert 'CI: determine actual LibreSSL version dynamically'
• DOC: config: clarify the -m dir and -m dom pattern matching methods
• DOC: config: clarify the fact that 'retries' is not just for connections
• DOC: config: explain how default matching method for ACL works
• DOC: config: clarify the fact that SNI should not be used in HTTP scenarios
• DOC: config: provide some configuration hints for 'http-reuse'
• BUILD: listener: fix build warning on global_listener_rwlock without threads
• BUILD: peers: Remove unused variables
• BUG/MEDIUM: peers: messages about unkown tables not correctly ignored
• BUG/MINOR: http_ana/txn: don't re-initialize txn and req var lists
• BUG/MEDIUM: listener: Fix race condition when updating the global mngmt task
• CI: emit the compiler's version in the build reports
• CI: add monthly gcc cross compile jobs
• BUG/MEDIUM: stick-table: fix a race condition when updating the expiration task
• BUG/MAJOR: stick-table: don't process store-response rules for applets
• DOC: management: add forgotten 'show startup-logs'
• CI: Replace the deprecated ::set-output command by writing to $GITHUB_OUTPUT in workflow definition
• CI: Replace the deprecated ::set-output command by writing to $GITHUB_OUTPUT in matrix.py
• BUG/MAJOR: stick-tables: do not try to index a server name for applets
• DOC: configuration: missing 'if' in tcp-request content example
• BUILD: http_fetch: silence an uninitiialized warning with gcc-4/5/6 at -Os
• BUG/MINOR: http-fetch: Update method after a prefetch in smp_fetch_meth()
• BUG/MEDIUM: lua: handle stick table implicit arguments right.
• BUILD: cfgparse: Fix GCC warning about a variable used after realloc
• BUILD: fix compilation for OpenSSL-3.0.0-alpha17
• BUG/MINOR: log: improper behavior when escaping log data
• SCRIPTS: announce-release: update some URLs to https
• BUG/MEDIUM: captures: free() an error capture out of the proxy lock
• BUG/MEDIUM: proxy: ensure pause_proxy() and resume_proxy() own PROXY_LOCK
• BUG/MINOR: signals/poller: ensure wakeup from signals
• BUG/MINOR: signals/poller: set the poller timeout to 0 when there are signals
• BUG/MINOR: h1: Support headers case adjustment for TCP proxies
• REGTESTS: http_request_buffer: Add a barrier to not mix up log messages
• BUG/MEDIUM: peers:…

This update for haproxy fixes the following issues:

• CVE-2023-0056: Fixed a server crash that could be triggered via a malformed HTTP/2 frame (bsc#1207181).

This update for haproxy fixes the following issues:

• CVE-2023-25725: Fixed a serious vulnerability in the HTTP/1 parser (bsc#1208132).
• CVE-2023-0056: Fixed denial of service via crash in http_wait_for_response() (bsc#1207181).

This update for haproxy fixes the following issues:

• CVE-2023-25725: Fixed a serious vulnerability in the HTTP/1 parser (bsc#1208132).
• CVE-2023-0056: Fixed denial of service via crash in http_wait_for_response() (bsc#1207181).

It was discovered that HAProxy incorrectly handled certain messages. A remote attacker could possibly use this issue to cause HAProxy to stop responding, resulting in a denial of service.