CVE-2023-0836: Infoleak
First published: Wed Mar 29 2023(Updated: )
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Haproxy Haproxy | >=2.2.0<2.2.27 | |
| Haproxy Haproxy | >=2.4.0<=2.4.21 | |
| Haproxy Haproxy | >=2.5.0<=2.5.11 | |
| Haproxy Haproxy | >=2.6.0<=2.6.8 | |
| Haproxy Haproxy | =2.1.0 | |
| Haproxy Haproxy | =2.3.0 | |
| Haproxy Haproxy | =2.7.0 | |
| debian/haproxy | 1.8.19-1+deb10u3 1.8.19-1+deb10u4 2.2.9-2+deb11u5 2.6.12-1 2.6.15-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.haproxy.org/?p=haproxy.git;a=commitdiff;h=2e6bf0a
- https://www.debian.org/security/2023/dsa-5388
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=2e6bf0a2722866ae0128a4392fa2375bd1f03ff8
- https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=f988992d16f45ef03d5bbb024a1042ed8123e4c5
- https://git.haproxy.org/?p=haproxy-2.2.git;a=commit;h=18575ba4e5057afdb80cc06135272889ae1fa2d1
- https://git.haproxy.org/?p=haproxy.git;a=commitdiff;h=63bbf284a131de362ad5b60d64ff3b1eff830553
- https://security-tracker.debian.org/tracker/CVE-2023-0836
- https://git.haproxy.org/?p=haproxy.git%3Ba=commitdiff%3Bh=2e6bf0a
Frequently Asked Questions
What is the vulnerability ID for this information leak vulnerability?
The vulnerability ID for this information leak vulnerability is CVE-2023-0836.
What is the severity of CVE-2023-0836?
The severity of CVE-2023-0836 is high with a severity value of 7.5.
Which software versions are affected by CVE-2023-0836?
The affected software versions of CVE-2023-0836 include HAProxy 2.1, 2.2 (up to 2.2.27), 2.3, 2.4 (up to 2.4.21), 2.5 (up to 2.5.11), 2.6 (up to 2.6.8), and 2.7 (up to 2.7.1).
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending specially crafted requests to the vulnerable HAProxy server which could lead to an information leak.
How can I fix CVE-2023-0836?
To fix CVE-2023-0836, it is recommended to upgrade to the patched versions of HAProxy, such as 2.2.27, 2.4.21, 2.5.11, 2.6.8, or 2.7.1, depending on the version you are using.
- collector/nvd-index
- collector/security-tracker-debian
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/haproxy
- canonical/haproxy haproxy
- version/haproxy haproxy/2.2.0
- version/haproxy haproxy/2.4.0
- version/haproxy haproxy/2.4.21
- version/haproxy haproxy/2.5.0
- version/haproxy haproxy/2.5.11
- version/haproxy haproxy/2.6.0
- version/haproxy haproxy/2.6.8
- version/haproxy haproxy/2.1.0
- version/haproxy haproxy/2.3.0
- version/haproxy haproxy/2.7.0
- package-manager/debian