USN-6294-1: HAProxy vulnerability
Ben Kallus discovered that HAProxy incorrectly handled empty Content-Length headers. A remote attacker could possibly use this issue to manipulate the payload and bypass certain restrictions.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this HAProxy vulnerability?
The vulnerability ID for this HAProxy vulnerability is USN-6294-1.
What is the description of the HAProxy vulnerability?
The HAProxy vulnerability involves incorrectly handling empty Content-Length headers, which allows a remote attacker to manipulate payload and bypass certain restrictions.
What software is affected by this vulnerability?
The affected software includes HAProxy version 2.6.9-1ubuntu1.1 in Ubuntu 23.04 and HAProxy version 2.4.22-0ubuntu0.22.04.2 in Ubuntu 22.04.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by manipulating the payload through empty Content-Length headers to bypass certain restrictions.
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following references: [CVE-2023-40225](https://ubuntu.com/security/CVE-2023-40225), [USN-6294-2](https://ubuntu.com/security/notices/USN-6294-2), and [Launchpad](https://launchpad.net/ubuntu/+source/haproxy/2.6.9-1ubuntu1.1).