CVE-2023-0056: Medium severity haproxy vulnerability
An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.
Other sources
Initial description: Router PODs frequently getting restarted and haproxy process is receiving the segfault but it is not generating coredump even though the core file size is unlimited.
Upstream bug: https://github.com/haproxy/haproxy/issues/1972
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-0056?
The severity of CVE-2023-0056 is medium, with a severity value of 6.5.
How does CVE-2023-0056 impact HAProxy?
CVE-2023-0056 can cause the HAProxy service to crash, impacting availability.
How can an attacker exploit CVE-2023-0056?
An authenticated remote attacker can exploit CVE-2023-0056 by running a specially crafted malicious server in an OpenShift cluster.
Which versions of HAProxy are affected by CVE-2023-0056?
HAProxy versions 0:2.4.17-3.el9_1.2, 0:2.4.7-2.el9_0.2, 0:2.2.19-3.el8, 0:2.2.24-2.el8, 0:2.2.24-3.rhaos4.13.el8, and 0:2.2.15-6.el8 are affected by CVE-2023-0056.
How can I fix CVE-2023-0056 in HAProxy?
To fix CVE-2023-0056 in HAProxy, update to version 0:2.4.17-3.el9_1.2 or apply the appropriate remedy provided by Redhat.