REDHAT-BUG-2490522: Integer Overflow
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
haproxyto a version that resolves this vulnerability.Patch 5985276
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Systems are exposed when HAProxy processes FastCGI records from a backend that can send malicious or compromised FastCGI responses. The issue can desynchronize HAProxy's FastCGI framing parser, with potential effects including request routing errors, response smuggling, or memory safety issues.
What conditions are required to exploit the flaw?
An attacker needs the ability to control or influence a FastCGI backend's records. Exploitation relies on a record with contentLength set to 65535 and paddingLength of at least 1, which causes the affected drl field to wrap to zero.
What should be done if an affected deployment is identified?
Update to a HAProxy version that includes commit 5985276. The provided information does not identify an alternative mitigation or configuration workaround.