CVE-2023-0056: Medium severity HAProxy HAProxy vulnerability
An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.
Other sources
Initial description: Router PODs frequently getting restarted and haproxy process is receiving the segfault but it is not generating coredump even though the core file size is unlimited.
Upstream bug: https://github.com/haproxy/haproxy/issues/1972
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.4.17-3.el9_1.2 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.4.7-2.el9_0.2 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.2.19-3.el8 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.2.24-2.el8 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.2.24-3.rhaos4.13.el8 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.2.15-6.el8 - Upgrade
Upgrade
debian/haproxyto a version that resolves this vulnerability.Fixed in 2.6.12-1+deb12u3Fixed in 2.6.12-1+deb12u4Fixed in 3.0.11-1+deb13u3Fixed in 3.0.11-1+deb13u4Fixed in 3.2.26-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-0056?
The severity of CVE-2023-0056 is medium, with a severity value of 6.5.
How does CVE-2023-0056 impact HAProxy?
CVE-2023-0056 can cause the HAProxy service to crash, impacting availability.
How can an attacker exploit CVE-2023-0056?
An authenticated remote attacker can exploit CVE-2023-0056 by running a specially crafted malicious server in an OpenShift cluster.
Which versions of HAProxy are affected by CVE-2023-0056?
HAProxy versions 0:2.4.17-3.el9_1.2, 0:2.4.7-2.el9_0.2, 0:2.2.19-3.el8, 0:2.2.24-2.el8, 0:2.2.24-3.rhaos4.13.el8, and 0:2.2.15-6.el8 are affected by CVE-2023-0056.
How can I fix CVE-2023-0056 in HAProxy?
To fix CVE-2023-0056 in HAProxy, update to version 0:2.4.17-3.el9_1.2 or apply the appropriate remedy provided by Redhat.