Veracode Vulnerability DatabaseVERACODE:11094Denial Of Service (DoS)
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
HAProxy is vulnerable to denial of service. Requests are not properly handled when the proxy had certain rules in its configuration that uses hdr_ip criterion. A remote attacker is able to crash the application using a malicious HTTP header with a certain value in the MAX_HDR_HISTORY variable.
| CPE | Name | Operator | Version |
|---|---|---|---|
| haproxy | eq | 1.4.22__5.el6op | |
| haproxy | eq | 1.4.22__4.el6op | |
| haproxy | eq | 1.4.22__4.el6_4 | |
| haproxy | eq | 1.4.22__5.el6_4 | |
| haproxy | eq | 1.4.22__3.el6 |
References
marc.info/?l=haproxy&m=137147915029705&w=2
rhn.redhat.com/errata/RHSA-2013-1120.html
rhn.redhat.com/errata/RHSA-2013-1204.html
secunia.com/advisories/54344
www.debian.org/security/2013/dsa-2711
www.ubuntu.com/usn/USN-1889-1
access.redhat.com/security/updates/classification/#moderate
access.redhat.com/support/offerings/techpreview/
bugzilla.redhat.com/show_bug.cgi?id=974259
rhn.redhat.com/errata/RHSA-2013-1120.html
Related
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P