BIT-haproxy-2023-0836: Infoleak
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGIBEGINREQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.2.27 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.4.21 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.5.11 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.6.8 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments are HAProxy instances in the listed vulnerable release lines that encode FCGI_BEGIN_REQUEST records for configured FastCGI backends. The disclosure is to those FastCGI backends.
Does exploitation require an authenticated user or user interaction?
No. The supplied vector indicates network access with low attack complexity, no privileges, and no user interaction.
What should be done to remediate the issue?
Upgrade to HAProxy 2.2.27, 2.4.21, 2.5.11, 2.6.8, or 2.7.1 or later within the applicable release line. HAProxy 2.1 and 2.3 are identified as affected, but no fixed versions for those branches are provided.
What is the impact of successful exploitation?
Five uninitialized bytes in a connection buffer can be disclosed while HAProxy encodes an FCGI_BEGIN_REQUEST record. The data may expose sensitive information to a configured FastCGI backend, with no stated integrity or availability impact.