CVE-2024-53008

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.(CVE-2024-53008)

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.(CVE-2024-53008)

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.(CVE-2024-53008)

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.(CVE-2024-53008)

Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.

Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.

This update for haproxy fixes the following issues:

• CVE-2024-53008: Fixed HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server (bsc#1233973)

Other fixes:

• Update to version 2.8.11

This update for haproxy fixes the following issues:

Update to version 2.8.11+git0.01c1056a4:

• VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server (bsc#1233973)
• BUG/MINOR: cfgparse-listen: fix option httpslog override warning message
• BUG/MEDIUM: promex: Wait to have the request before sending the response
• BUG/MEDIUM: cache/stats: Wait to have the request before sending the response
• BUG/MEDIUM: queue: implement a flag to check for the dequeuing
• BUG/MINOR: clock: validate that now_offset still applies to the current date
• BUG/MINOR: clock: make time jump corrections a bit more accurate
• BUG/MINOR: polling: fix time reporting when using busy polling
• BUG/MAJOR: mux-h1: Wake SC to perform 0-copy forwarding in CLOSING state
• BUG/MEDIUM: pattern: prevent UAF on reused pattern expr
• BUG/MINOR: pattern: prevent const sample from being tampered in pat_match_beg()
• BUG/MEDIUM: clock: detect and cover jumps during execution
• REGTESTS: fix random failures with wrong_ip_port_logging.vtc under load
• DOC: configuration: place the HAPROXY_HTTP_LOG_FMT example on the correct line
• BUG/MINOR: pattern: do not leave a leading comma on "set" error messages
• BUG/MINOR: pattern: pat_ref_set: return 0 if err was found
• BUG/MINOR: pattern: pat_ref_set: fix UAF reported by coverity
• BUG/MINOR: stconn: Request to send something to be woken up when the pipe is full
• BUG/MEDIUM: mux-pt/mux-h1: Release the pipe on connection error on sending path
• BUG/MEDIUM: clock: also update the date offset on time jumps
• DOC: config: correct the table for option tcplog
• BUG/MINOR: h3: properly reject too long header responses
• BUG/MINOR: proto_uxst: delete fd from fdtab if listen() fails
• BUG/MINOR: mux-quic: do not send too big MAX_STREAMS ID
• REGTESTS: mcli: test the pipelined commands on master CLI
• BUG/MEDIUM: mworker/cli: fix pipelined modes on master CLI
• MINOR: channel: implement ci_insert() function
• BUG/MINOR: proto_tcp: keep error msg if listen() fails
• BUG/MINOR: proto_tcp: delete fd from fdtab if listen() fails
• BUG/MINOR: quic/trace: make quic_conn_enc_level_init() emit NEW not CLOSE
• BUG/MINOR: trace/quic: make "qconn" selectable as a lockon criterion
• BUG/MINOR: trace: automatically start in waiting mode with "start <evt>"
• BUG/MEDIUM: trace: fix null deref in lockon mechanism since TRACE_ENABLED()
• BUG/MINOR: trace/quic: permit to lock on frontend/connect/session etc
• BUG/MINOR: trace/quic: enable conn/session pointer recovery from quic_conn
• BUG/MINOR: fcgi-app: handle a possible strdup() failure
• BUG/MEDIUM: mux-h2: Propagate term flags to SE on error in h2s_wake_one_stream
• BUG/MEDIUM: h2: Only report early HTX EOM for tunneled streams
• BUG/MEDIUM: http-ana: Report error on write error waiting for the response
• BUG/MEDIUM: quic: prevent conn freeze on 0RTT undeciphered content
• BUG/MEDIUM: stconn: Report error on SC on send if a previous SE error was set
• BUG/MEDIUM: mux-h1: Properly handle empty message when an error is triggered
• BUG/MEDIUM: cli: Always release back endpoint between two commands on the mcli
• BUG/MEDIUM: stream: Prevent mux upgrades if client connection is no longer ready
• BUG/MEDIUM: init: fix fd_hard_limit default in compute_ideal_maxconn
• MEDIUM: init: set default for fd_hard_limit via DEFAULT_MAXFD (take #2)
• BUG/MEDIUM: queue: deal with a rare TOCTOU in assign_server_and_queue()
• MINOR: queue: add a function to check for TOCTOU after queueing
• BUG/MEDIUM: jwt: Clear SSL error queue on error when checking the signature
• BUG/MINOR: quic: Lack of precision when computing K (cubic only cc)
• BUG/MINOR: cli: Atomically inc the global request counter between CLI commands
• BUG/MINOR: server: Don't warn fallback IP is used during init-addr resolution
• BUG/MINOR: stick-table: fix crash for src_inc_gpc() without stkcounter
• DOC: config: improve the http-keep-alive section
• DOC: configuration:…

This update for haproxy fixes the following issues:

Update to version 2.8.11+git0.01c1056a4:

• VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server (bsc#1233973)
• BUG/MINOR: cfgparse-listen: fix option httpslog override warning message
• BUG/MEDIUM: promex: Wait to have the request before sending the response
• BUG/MEDIUM: cache/stats: Wait to have the request before sending the response
• BUG/MEDIUM: queue: implement a flag to check for the dequeuing
• BUG/MINOR: clock: validate that now_offset still applies to the current date
• BUG/MINOR: clock: make time jump corrections a bit more accurate
• BUG/MINOR: polling: fix time reporting when using busy polling
• BUG/MAJOR: mux-h1: Wake SC to perform 0-copy forwarding in CLOSING state
• BUG/MEDIUM: pattern: prevent UAF on reused pattern expr
• BUG/MINOR: pattern: prevent const sample from being tampered in pat_match_beg()
• BUG/MEDIUM: clock: detect and cover jumps during execution
• REGTESTS: fix random failures with wrong_ip_port_logging.vtc under load
• DOC: configuration: place the HAPROXY_HTTP_LOG_FMT example on the correct line
• BUG/MINOR: pattern: do not leave a leading comma on "set" error messages
• BUG/MINOR: pattern: pat_ref_set: return 0 if err was found
• BUG/MINOR: pattern: pat_ref_set: fix UAF reported by coverity
• BUG/MINOR: stconn: Request to send something to be woken up when the pipe is full
• BUG/MEDIUM: mux-pt/mux-h1: Release the pipe on connection error on sending path
• BUG/MEDIUM: clock: also update the date offset on time jumps
• DOC: config: correct the table for option tcplog
• BUG/MINOR: h3: properly reject too long header responses
• BUG/MINOR: proto_uxst: delete fd from fdtab if listen() fails
• BUG/MINOR: mux-quic: do not send too big MAX_STREAMS ID
• REGTESTS: mcli: test the pipelined commands on master CLI
• BUG/MEDIUM: mworker/cli: fix pipelined modes on master CLI
• MINOR: channel: implement ci_insert() function
• BUG/MINOR: proto_tcp: keep error msg if listen() fails
• BUG/MINOR: proto_tcp: delete fd from fdtab if listen() fails
• BUG/MINOR: quic/trace: make quic_conn_enc_level_init() emit NEW not CLOSE
• BUG/MINOR: trace/quic: make "qconn" selectable as a lockon criterion
• BUG/MINOR: trace: automatically start in waiting mode with "start <evt>"
• BUG/MEDIUM: trace: fix null deref in lockon mechanism since TRACE_ENABLED()
• BUG/MINOR: trace/quic: permit to lock on frontend/connect/session etc
• BUG/MINOR: trace/quic: enable conn/session pointer recovery from quic_conn
• BUG/MINOR: fcgi-app: handle a possible strdup() failure
• BUG/MEDIUM: mux-h2: Propagate term flags to SE on error in h2s_wake_one_stream
• BUG/MEDIUM: h2: Only report early HTX EOM for tunneled streams
• BUG/MEDIUM: http-ana: Report error on write error waiting for the response
• BUG/MEDIUM: quic: prevent conn freeze on 0RTT undeciphered content
• BUG/MEDIUM: stconn: Report error on SC on send if a previous SE error was set
• BUG/MEDIUM: mux-h1: Properly handle empty message when an error is triggered
• BUG/MEDIUM: cli: Always release back endpoint between two commands on the mcli
• BUG/MEDIUM: stream: Prevent mux upgrades if client connection is no longer ready
• BUG/MEDIUM: init: fix fd_hard_limit default in compute_ideal_maxconn
• MEDIUM: init: set default for fd_hard_limit via DEFAULT_MAXFD (take #2)
• BUG/MEDIUM: queue: deal with a rare TOCTOU in assign_server_and_queue()
• MINOR: queue: add a function to check for TOCTOU after queueing
• BUG/MEDIUM: jwt: Clear SSL error queue on error when checking the signature
• BUG/MINOR: quic: Lack of precision when computing K (cubic only cc)
• BUG/MINOR: cli: Atomically inc the global request counter between CLI commands
• BUG/MINOR: server: Don't warn fallback IP is used during init-addr resolution
• BUG/MINOR: stick-table: fix crash for…

Yuki Mogi discovered that HAProxy incorrectly handled the interpretation of certain HTTP requests. A remote attacker could possibly use this issue to perform a request smuggling attack and obtain sensitive information.