PT-2023-8866 · Haproxy+8 · Haproxy+8

Published 2023-08-10 · Updated 2025-01-20 · CVE-2023-40225

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HAProxy versions 2.0.32 through 2.8.1 HAProxy versions 2.1.x HAProxy versions 2.2.x through 2.2.30 HAProxy versions 2.3.x HAProxy versions 2.4.x through 2.4.23 HAProxy versions 2.5.x HAProxy versions 2.6.x before 2.6.15 HAProxy versions 2.7.x before 2.7.10 HAProxy versions 2.8.x before 2.8.2

Description The issue is related to HAProxy forwarding empty Content-Length headers, which violates RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request. This can be exploited by a remote attacker to perform an HTTP request smuggling attack.

Recommendations For HAProxy versions 2.0.32 through 2.8.1, update to version 2.8.3 or later. For HAProxy versions 2.1.x, update to version 2.8.3 or later. For HAProxy versions 2.2.x through 2.2.30, update to version 2.8.3 or later. For HAProxy versions 2.3.x, update to version 2.8.3 or later. For HAProxy versions 2.4.x through 2.4.23, update to version 2.8.3 or later. For HAProxy versions 2.5.x, update to version 2.8.3 or later. For HAProxy versions 2.6.x before 2.6.15, update to version 2.6.15 or later. For HAProxy versions 2.7.x before 2.7.10, update to version 2.7.10 or later. For HAProxy versions 2.8.x before 2.8.2, update to version 2.8.3 or later.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALSA-2024:1142

ALT-PU-2023-5064

ALT-PU-2023-5066

ALT-PU-2023-5100

AZL-27912

BDU:2024-02429

BIT-HAPROXY-2023-40225

CVE-2023-40225

DSA-5590-1

INFSA-2024_1142

MGASA-2023-0320

OESA-2023-1541

OPENSUSE-SU-2023_3469-1

OPENSUSE-SU-2024:13116-1

RHSA-2023:7473

RHSA-2023:7606

RHSA-2024:0200

RHSA-2024:0308

RHSA-2024:1089

RHSA-2024:1142

RHSA-2024_1142

ROSA-SA-2024-2400

SUSE-SU-2023:3469-1

SUSE-SU-2023:3490-1

SUSE-SU-2023:4646-1

SUSE-SU-2023_3469-1

SUSE-SU-2023_3490-1

SUSE-SU-2023_4646-1

USN-6294-1

USN-6294-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Haproxy

Linuxmint

Red Hat

Red Os

Suse

Ubuntu

References · 57

• 🔥 https://github.com/haproxy/haproxy/issues/2237 · Exploit
• https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856 · Patch
• https://ubuntu.com/security/notices/USN-6294-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0320 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4646-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-40225 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40225 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3469-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40225 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-40225 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-1142.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40225 · Security Note
• https://osv.dev/vulnerability/BIT-haproxy-2023-40225 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6294-2 · Vendor Advisory