BIT-haproxy-2023-25725: Critical severity HAProxy HAProxy vulnerability

Q: Which deployments are most exposed to access-control bypass?

HTTP/1.0 and HTTP/1.1 traffic is the primary concern because malformed headers can cause subsequently parsed headers to disappear. Deployments that rely on HTTP headers for access-control decisions are therefore exposed.

Q: Does an attacker need authentication or user interaction to exploit this issue?

No. The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

Q: Are HTTP/2 and HTTP/3 deployments affected in the same way?

No. For HTTP/2 and HTTP/3, the impact is limited because the affected headers disappear before parsing and processing, as though the client had not sent them.

Q: Which HAProxy releases contain the fix?

The fixed releases are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31. Versions earlier than 2.7.3 are described as affected, with fixes provided in these maintained release lines.

Published Feb 14, 2023

Updated

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.

Affected Software

1 affected component

HAProxy HAProxy<2.7.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HAProxy to a version that resolves this vulnerability.
Fixed in 2.7.3
Upgrade
Upgrade HAProxy to a version that resolves this vulnerability.
Fixed in 2.6.9
Upgrade
Upgrade HAProxy to a version that resolves this vulnerability.
Fixed in 2.5.12
Upgrade
Upgrade HAProxy to a version that resolves this vulnerability.
Fixed in 2.4.22
Upgrade
Upgrade HAProxy to a version that resolves this vulnerability.
Fixed in 2.2.29
Upgrade
Upgrade HAProxy to a version that resolves this vulnerability.
Fixed in 2.0.31

Event History

Feb 14, 2023

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverity

Frequently Asked Questions

Which deployments are most exposed to access-control bypass?

HTTP/1.0 and HTTP/1.1 traffic is the primary concern because malformed headers can cause subsequently parsed headers to disappear. Deployments that rely on HTTP headers for access-control decisions are therefore exposed.

Does an attacker need authentication or user interaction to exploit this issue?

No. The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

Are HTTP/2 and HTTP/3 deployments affected in the same way?

No. For HTTP/2 and HTTP/3, the impact is limited because the affected headers disappear before parsing and processing, as though the client had not sent them.

Which HAProxy releases contain the fix?

The fixed releases are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31. Versions earlier than 2.7.3 are described as affected, with fixes provided in these maintained release lines.

BIT-haproxy-2023-25725: Critical severity HAProxy HAProxy vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed to access-control bypass?

Does an attacker need authentication or user interaction to exploit this issue?

Are HTTP/2 and HTTP/3 deployments affected in the same way?

Which HAProxy releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to access-control bypass?

Does an attacker need authentication or user interaction to exploit this issue?

Are HTTP/2 and HTTP/3 deployments affected in the same way?

Which HAProxy releases contain the fix?