SUSE SLES15 / openSUSE 15 Security Update : haproxy (SUSE-SU-2023:3469-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3469-1 advisory. - CVE-2023-40225: Fixed request smuggling with empty content-length header value bsc1214102. Tenable has extracted the preceding descripti...

SUSE-SU-2023:3469-1 Security update for haproxy

This update for haproxy fixes the following issues: - CVE-2023-40225: Fixed request smuggling with empty content-length header value bsc1214102...

Medium: haproxy

Issue Overview: HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind...

Amazon Linux 2023 : haproxy (ALAS2023-2023-293)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-293 advisory. HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers,...

HTTP Request Smuggling

Haproxy is vulnerable to HTTP Request Smuggling. This vulnerability exists in the HTTP/1 server, which interprets a payload as an extra request due to empty Content-Length headers being forwarded. This allows an attacker to inject malicious payloads into the system...

Important Photon OS Security Update - PHSA-2023-3.0-0637

Updates of 'gdb', 'haproxy', 'iperf', 'nxtgn-openssl' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-4.0-0455

Updates of 'haproxy' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-5.0-0075

Updates of 'haproxy' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2023-5.0-91-0075

Updates of 'haproxy' packages of Photon OS have been released...

HAProxy through 2.0.32 2.1.x and 2.2.x through 2.2.30 2.3.x and 2.4.x through 2.4.23 2.5.x and 2.6.x before 2.6.15 2.7.x before 2.7.10 and 2.8.x before 2.8.2 forwards empty Content-Length headers violating RFC 9110 section 8.6. In uncommon cases an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

...

Ubuntu: Security Advisory (USN-6294-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6294-2: HAProxy vulnerability

USN-6294-1 fixed vulnerabilities in HAProxy. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly use this issue to manipulate the paylo...

USN-6294-2 haproxy vulnerability

USN-6294-1 fixed vulnerabilities in HAProxy. This update provides the corresponding updates for Ubuntu 20.04 LTS. Original advisory details: Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly use this issue to manipulate the paylo...

Ubuntu: Security Advisory (USN-6294-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 20.04 LTS : HAProxy vulnerability (USN-6294-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6294-2 advisory. USN-6294-1 fixed vulnerabilities in HAProxy. This update provides the corresponding updates for Ubuntu 20.04 LTS. Tenable has extracted the preceding description...

USN-6294-1 haproxy vulnerability

Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly use this issue to manipulate the payload and bypass certain restrictions...

USN-6294-1: HAProxy vulnerability

Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly use this issue to manipulate the payload and bypass certain restrictions...

Ubuntu 22.04 LTS / 23.04 : HAProxy vulnerability (USN-6294-1)

The remote Ubuntu 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6294-1 advisory. Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly use this issue to manipulate the...

CVE-2023-40225

A flaw was found in HAProxy. Empty Content-Length headers are forwarded, which could cause an HTTP/1 server behind it to interpret the payload as an extra request. This may render the HTTP/1 server vulnerable to attacks in some uncommon cases. Mitigation This flaw can be mitigated by applying a...

GHSA-QPPV-J76H-2RPX Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths

Summary Tornado interprets -, +, and in chunk length and Content-Length values, which are not allowed by the HTTP RFCs. This can result in request smuggling when Tornado is deployed behind certain proxies that interpret those non-standard characters differently. This is known to apply to older...