Bug 2185854 (CVE-2023-25950)

Summary: CVE-2023-25950 haproxy: malformed HTTP header field name can lead to HTTP request/response smuggling
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, aoconnor, bniver, dfreiber, flucifre, gmeno, hhorak, jburrell, jorton, mbenjamin, mhackett, rogbas, rohara, sostapov, vereddy, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: haproxy 2.7.1, haproxy 2.6.8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2186680, 2186681, 2186682, 2186683, 2186684, 2187250    
Bug Blocks: 2185855    

Description Mauro Matteo Cascella 2023-04-11 12:34:23 UTC 
HAProxy's HTTP/3 implementation fails to block a malformed HTTP header field name, and when deployed in front of a server that incorrectly process this malformed header, it may be used to conduct an HTTP request/response smuggling attack. A remote attacker may alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

Reference:
https://jvn.jp/en/jp/JVN38170084/

Upstream commit:
https://git.haproxy.org/?p=haproxy-2.7.git;a=commit;h=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46
Comment 1 Sandipan Roy 2023-04-14 06:17:00 UTC 
Created haproxy tracking bugs for this issue:

Affects: fedora-all [bug 2186680]


Created haproxy18 tracking bugs for this issue:

Affects: epel-all [bug 2186681]