DSA-5102: -1 haproxy -- security update

Published Mar 13, 2022

Updated

A flaw was discovered in the way HAProxy, a fast and reliable load balancing reverse proxy, processes HTTP responses containing the "Set-Cookie2" header, which can result in an unbounded loop, causing a denial of service.

Affected Software

2 affected components

debian/haproxy

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade haproxy to a version that resolves this vulnerability.
Patch DSA-5102-1

Event History

Mar 13, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-0711

Frequently Asked Questions

What traffic is needed to trigger the denial of service?

HAProxy must process an HTTP response containing a Set-Cookie2 header. The provided information does not specify whether an attacker can supply such a response directly or must control an upstream application or server.

What is the operational impact of successful exploitation?

Processing the affected response can enter an unbounded loop, resulting in a denial of service.