Bug 1136552 – CVE-2014-6269 haproxy: remote client denial of service vulnerability

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1136552 - (CVE-2014-6269) CVE-2014-6269 haproxy: remote client denial of service vulnerability

Summary:	CVE-2014-6269 haproxy: remote client denial of service vulnerability

Status:	CLOSED ERRATA

Aliases:	CVE-2014-6269

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140805,repor...
Keywords:	Security

Depends On:	1136698 1138191 1138193 1139924
Blocks:	1136553 1146224
	Show dependency tree / graph

Reported:	2014-09-02 17:16 EDT by Vincent Danen
Modified:	2014-11-10 05:10 EST (History)
CC List:	18 users (show)

See Also:
Fixed In Version:	haproxy 1.5.4
Doc Type:	Bug Fix
Doc Text:	A buffer overflow flaw was discovered in the way HAProxy handled, under very specific conditions, data uploaded from a client. A remote attacker could possibly use this flaw to crash HAProxy.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-11-07 00:24:22 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:1292	normal	SHIPPED_LIVE	Moderate: haproxy security update	2014-09-24 05:23:59 EDT

Groups: None (edit)

Description Vincent Danen 2014-09-02 17:16:10 EDT

A denial of service vulnerability was reported [1],[2] in HAProxy 1.5dev23 through to and including 1.5.3, and 1.6-dev.  A remote client could cause the HAProxy service to crash in specific conditions with a certain amount of server complicity (it must accept and slowly drain more than 2GB of data).  There is no possibility of code execution or loss of data integrity.

This is corrected in upstream version 1.5.4 [3].

[1] http://article.gmane.org/gmane.comp.web.haproxy/17726
[2] http://article.gmane.org/gmane.comp.web.haproxy/18097
[3] http://git.haproxy.org/?p=haproxy-1.5.git;a=commitdiff;h=b4d05093bc89f71377230228007e69a1434c1a0c

Comment 11 Murray McAllister 2014-09-09 23:09:22 EDT

CVE request: http://www.openwall.com/lists/oss-security/2014/09/09/18

Comment 12 Murray McAllister 2014-09-09 23:11:13 EDT

Created haproxy tracking bugs for this issue:

Affects: fedora-20 [bug 1139924]

Comment 15 Martin Prpič 2014-09-19 05:12:47 EDT

IssueDescription:

A buffer overflow flaw was discovered in the way HAProxy handled, under very specific conditions, data uploaded from a client. A remote attacker could possibly use this flaw to crash HAProxy.

Comment 16 errata-xmlrpc 2014-09-24 01:24:13 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1292 https://rhn.redhat.com/errata/RHSA-2014-1292.html

Note You need to log in before you can comment on or make changes to this bug.