Bug 1582635 (CVE-2018-11469)

Summary:	CVE-2018-11469 haproxy: Information disclosure in check_request_for_cacheability function in proto_http.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, bleanhar, bperkins, carlwgeorge, ccoleman, dedgar, dmcphers, hhorak, jeremy, jgoulding, jokerman, jorton, mchappel, pasik, rohara
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	haproxy 1.8.10	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-07-12 13:05:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1582636, 1584787, 1584788
Bug Blocks:	1582637

Description Pedro Sampaio 2018-05-25 19:51:50 UTC

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.

Upstream patch:

https://git.haproxy.org/?p=haproxy-1.8.git;a=commit;h=17514045e5d934dede62116216c1b016fe23dd06

Comment 1 Pedro Sampaio 2018-05-25 19:52:17 UTC

Created haproxy tracking bugs for this issue:

Affects: fedora-all [bug 1582636]

Comment 4 Scott Gayou 2018-05-31 16:25:13 UTC

Statement:

Red Hat Product Security has rated this issue as having a security impact of Moderate, and a future update may address this flaw.

Comment 8 Jason Shepherd 2018-06-04 03:54:14 UTC

Openshift Container Platform does not make use of cache features available in HAProxy. See the upstream haproxy configuration template here:

https://github.com/openshift/origin/blob/1cdf91738ccf94ddc94cd96d0cb9907e9de89f75/images/router/haproxy/conf/haproxy-config.template

Comment 9 errata-xmlrpc 2019-06-11 12:01:30 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1436 https://access.redhat.com/errata/RHSA-2019:1436

Comment 10 Product Security DevOps Team 2019-07-12 13:05:35 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-11469