CVE-2023-40225

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.(CVE-2023-40225)

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

• haproxy: Proxy forwards malformed empty Content-Length headers (CVE-2023-40225)
• haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers (CVE-2023-45539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

• CVE-2023-40225: Fix forward empty Content-Length headers issue

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

Haproxy has fixed security and other issues in last upstream version 2.8.3 of branch 2.8

Default user access are now commented out to prevent local action possible exploit and prevent further rpmnew on future updates.

Use a check script to have config check result in error log on failure.

Fix corruption with non empty access log.

Fixed major bug list:

• quic: Really ignore malformed ACK frames
• http-ana: Get a fresh trash buffer for each header value replacement
• h3: reject header values containing invalid chars
• http: reject any empty content-length header value (CVE-2023-40225)

Fixed medium bug list:

• quic: fix tasklet_wakeup loop on connection closing
• stconn: Update stream expiration date on blocked sends
• stconn: Wake applets on sending path if there is a pending shutdown
• stconn: Don't block sends if there is a pending shutdown
• h1-htx: Ensure chunked parsing with full output buffer
• applet: Fix API for function to push new data in channels buffer
• stconn: Report read activity when a stream is attached to front SC
• applet: Report an error if applet request more room on aborted SC
• stconn/stream: Forward shutdown on write timeout
• stconn: Always update stream's expiration date after I/O
• capabilities: enable support for Linux capabilities
• sink: invalid server list in sink_new_from_logsrv()
• log: improper use of logsrv->maxlen for buffer targets
• quic: token IV was not computed using a strong secret
• quic: missing check of dcid for init pkt including a token
• quic: timestamp shared in token was using internal time clock
• hlua_fcn/queue: bad pop_wait sequencing
• listener: Acquire proxy's lock in relax_listener() if necessary
• h3: Properly report a C-L header was found to the HTX start-line
• h3: Be sure to handle fin bit on the last DATA frame
• bwlim: Reset analyse expiration date when then channel analyse ends
• quic: consume contig space on requeue datagram

These are all security issues fixed in the haproxy-2.8.2+git0.61a0f576a-2.1 package on the GA media of openSUSE Tumbleweed.

This update for haproxy fixes the following issues:

• CVE-2023-40225: Fixed request smuggling with empty content-length header value (bsc#1214102).

This update for haproxy fixes the following issues:

• CVE-2023-40225: Fixed request smuggling with empty content-length header value (bsc#1214102).

This update for haproxy fixes the following issues:

• CVE-2023-45539: Fixed misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653).
• CVE-2023-40225: reject any empty content-length header value (bsc#1214102).

Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly use this issue to manipulate the payload and bypass certain restrictions.

USN-6294-1 fixed vulnerabilities in HAProxy. This update provides the corresponding updates for Ubuntu 20.04 LTS.

Original advisory details:

Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly use this issue to manipulate the payload and bypass certain restrictions.