USN-7135-1: HAProxy vulnerability
Bahruz Jabiyev, Anthony Gavazzi, Engin Kirda, Kaan Onarlioglu, Adi Peleg, and Harvey Tuch discovered that HAProxy incorrectly handled empty header names. A remote attacker could possibly use this issue to manipulate headers and bypass certain authentication checks and restrictions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7135-1?
The severity of USN-7135-1 is considered high due to the potential for remote attackers to manipulate headers.
How do I fix USN-7135-1?
To fix USN-7135-1, update to HAProxy version 1.6.3-1ubuntu0.3+esm2 or later.
Which software versions are affected by USN-7135-1?
USN-7135-1 affects HAProxy versions prior to 1.6.3-1ubuntu0.3+esm2 on Ubuntu 16.04.
What could happen if USN-7135-1 is exploited?
If exploited, USN-7135-1 could allow a remote attacker to bypass authentication checks.
Who discovered the vulnerability in USN-7135-1?
The vulnerability in USN-7135-1 was discovered by Bahruz Jabiyev, Anthony Gavazzi, Engin Kirda, Kaan Onarlioglu, Adi Peleg, and Harvey Tuch.