CVE-2023-0836: Infoleak
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGIBEGINREQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.
https://git.haproxy.org/?p=haproxy.git;a=commitdiff;h=2e6bf0a
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/haproxyto a version that resolves this vulnerability.Fixed in 1.8.19-1+deb10u3Fixed in 1.8.19-1+deb10u4Fixed in 2.2.9-2+deb11u5Fixed in 2.6.12-1Fixed in 2.6.15-1 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.8 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.7.1 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.6.8 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.5.11 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.4.21 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.2.27 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.2.27 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.4.21 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.5.11 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.6.8 - Upgrade
Upgrade
HAProxyto a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this information leak vulnerability?
The vulnerability ID for this information leak vulnerability is CVE-2023-0836.
What is the severity of CVE-2023-0836?
The severity of CVE-2023-0836 is high with a severity value of 7.5.
Which software versions are affected by CVE-2023-0836?
The affected software versions of CVE-2023-0836 include HAProxy 2.1, 2.2 (up to 2.2.27), 2.3, 2.4 (up to 2.4.21), 2.5 (up to 2.5.11), 2.6 (up to 2.6.8), and 2.7 (up to 2.7.1).
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending specially crafted requests to the vulnerable HAProxy server which could lead to an information leak.
How can I fix CVE-2023-0836?
To fix CVE-2023-0836, it is recommended to upgrade to the patched versions of HAProxy, such as 2.2.27, 2.4.21, 2.5.11, 2.6.8, or 2.7.1, depending on the version you are using.