Bug 2053666 (CVE-2022-0711)
Summary: | CVE-2022-0711 haproxy: Denial of service via set-cookie2 header | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | amcdermo, amctagga, aos-bugs, aos-network-edge-staff, bmontgom, bperkins, eparis, gspence, hhorak, jburrell, jeremy, jokerman, jorton, mmasters, nstielau, rohara, security-response-team, sponnaga, vkumar, vwalek |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | haproxy 2.5.2 | Doc Type: | If docs needed, set a value |
Doc Text: |
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2022-03-29 10:01:11 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 2055334, 2058740, 2058741, 2058742, 2058743, 2058744, 2058745, 2059431, 2059432, 2059433, 2059434, 2059435, 2059436, 2059437, 2059438, 2059440, 2059442, 2070448, 2070461 | ||
Bug Blocks: | 2053667 |
Description
Pedro Sampaio
2022-02-11 17:35:36 UTC
Created haproxy tracking bugs for this issue: Affects: fedora-all [bug 2059440] This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.9 Via RHSA-2022:1021 https://access.redhat.com/errata/RHSA-2022:1021 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-0711 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.8 Via RHSA-2022:1153 https://access.redhat.com/errata/RHSA-2022:1153 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.7 Via RHSA-2022:1336 https://access.redhat.com/errata/RHSA-2022:1336 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.6 Via RHSA-2022:1620 https://access.redhat.com/errata/RHSA-2022:1620 |