CVE-2023-0836: Infoleak
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGIBEGINREQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this information leak vulnerability?
The vulnerability ID for this information leak vulnerability is CVE-2023-0836.
What is the severity of CVE-2023-0836?
The severity of CVE-2023-0836 is high with a severity value of 7.5.
Which software versions are affected by CVE-2023-0836?
The affected software versions of CVE-2023-0836 include HAProxy 2.1, 2.2 (up to 2.2.27), 2.3, 2.4 (up to 2.4.21), 2.5 (up to 2.5.11), 2.6 (up to 2.6.8), and 2.7 (up to 2.7.1).
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending specially crafted requests to the vulnerable HAProxy server which could lead to an information leak.
How can I fix CVE-2023-0836?
To fix CVE-2023-0836, it is recommended to upgrade to the patched versions of HAProxy, such as 2.2.27, 2.4.21, 2.5.11, 2.6.8, or 2.7.1, depending on the version you are using.