Bug 2329284 (CVE-2024-53008)

Summary: CVE-2024-53008 HAProxy: HTTP request smuggling in HAProxy
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, aoconnor, bniver, flucifre, gmeno, mbenjamin, mhackett, oalbrigt, sostapov, vereddy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in HAProxy. This vulnerability allows a remote attacker to access a path restricted by the Access Control List (ACL) set on the product. As a result, the attacker may obtain sensitive information.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2329292, 2329293, 2329294    
Bug Blocks:    

Description OSIDB Bzimport 2024-11-28 03:01:14 UTC 
Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited,  a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.
Comment 2 Oyvind Albrigtsen 2025-01-06 09:33:02 UTC 
The CVE has been fixed in v3.0.3: https://nvd.nist.gov/vuln/detail/CVE-2024-53008