Bug 2185854 (CVE-2023-25950) - CVE-2023-25950 haproxy: malformed HTTP header field name can lead to HTTP request/response smuggling
Summary: CVE-2023-25950 haproxy: malformed HTTP header field name can lead to HTTP req...
Keywords:
Status: NEW
Alias: CVE-2023-25950
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2186680 2186681 2186682 2186683 2186684 2187250
Blocks: 2185855
TreeView+ depends on / blocked
 
Reported: 2023-04-11 12:34 UTC by Mauro Matteo Cascella
Modified: 2023-09-26 21:56 UTC (History)
16 users (show)

Fixed In Version: haproxy 2.7.1, haproxy 2.6.8
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Mauro Matteo Cascella 2023-04-11 12:34:23 UTC 
HAProxy's HTTP/3 implementation fails to block a malformed HTTP header field name, and when deployed in front of a server that incorrectly process this malformed header, it may be used to conduct an HTTP request/response smuggling attack. A remote attacker may alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

Reference:
https://jvn.jp/en/jp/JVN38170084/

Upstream commit:
https://git.haproxy.org/?p=haproxy-2.7.git;a=commit;h=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46
Comment 1 Sandipan Roy 2023-04-14 06:17:00 UTC 
Created haproxy tracking bugs for this issue:

Affects: fedora-all [bug 2186680]


Created haproxy18 tracking bugs for this issue:

Affects: epel-all [bug 2186681]
Note You need to log in before you can comment on or make changes to this bug.