Inconsistent interpretation of HTTP requests in HAProxy - CVE-2023-40225

Vulnerability identifier: #VU79767

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-40225

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request with empty Content-Length headers to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

HAProxy
Amazon Linux AMI
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
openSUSE Leap Micro
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
SUSE Linux Enterprise Server 15 SP1 Business Critical Linux
SUSE Linux Enterprise Server 15 SP2 Business Critical Linux
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
openSUSE Leap
openEuler
Ubuntu
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox (Red Hat package)
rust-bootupd (Red Hat package)
coreos-installer (Red Hat package)
python-eventlet (Red Hat package)
runc (Red Hat package)
containernetworking-plugins (Red Hat package)
skopeo (Red Hat package)
crun (Red Hat package)
cri-o (Red Hat package)
cri-tools (Red Hat package)
buildah (Red Hat package)
haproxy (Ubuntu package)
haproxy-debuginfo
haproxy-debugsource
haproxy
python-markupsafe (Red Hat package)
conmon (Red Hat package)
python-werkzeug (Red Hat package)
haproxy (Debian package)
haproxy-help
haproxy (Red Hat package)
haproxy-doc
ignition (Red Hat package)
container-selinux (Red Hat package)
podman (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
rust-afterburn (Red Hat package)
ostree (Red Hat package)
rpm-ostree (Red Hat package)
IBM Security Verify Access

Install updates from vendor's website.

HAProxy - addressed in versions 2.6.15, 2.7.10, 2.8.2
Red Hat OpenShift Container Platform - addressed in versions 4.11.57, 4.12.47, 4.15.0
toolbox (Red Hat package) - update to 0.1.2-1.rhaos4.15.el9
rust-bootupd (Red Hat package) - update to 0.2.17-1.el9
coreos-installer (Red Hat package) - update to 0.17.0-3.rhaos4.15.el9
python-eventlet (Red Hat package) - update to 0.33.1-5.el9
runc (Red Hat package) - update to 1.1.12-1.rhaos4.15.el9
containernetworking-plugins (Red Hat package) - addressed in versions 1.4.0-1.rhaos4.11.el8, 1.4.0-1.rhaos4.12.el8
skopeo (Red Hat package) - update to 1.11.2-21.1.rhaos4.15.el9
crun (Red Hat package) - update to 1.14-1.rhaos4.15.el9
cri-o (Red Hat package) - addressed in versions 1.25.5-4.rhaos4.12.git778644f.el8, 1.27.2-2.rhaos4.14.git9d684e2.el8, 1.27.2-2.rhaos4.14.git9d684e2.el9, 1.28.3-14.rhaos4.15.git33aabd8.el9
cri-tools (Red Hat package) - update to 1.28.0-3.el9
buildah (Red Hat package) - update to 1.29.1-20.2.rhaos4.15.el9
haproxy (Ubuntu package) - addressed in versions 2.0.31-0ubuntu0.2, 2.4.22-0ubuntu0.22.04.2, 2.6.9-1ubuntu1.1
haproxy-debuginfo - addressed in versions 2.0.31-150100.8.34.1, 2.0.31-150200.11.23.1, 2.4.22+git0.f8e3218e2-150400.3.16.1
haproxy-debugsource - addressed in versions 2.0.31-150100.8.34.1, 2.0.31-150200.11.23.1, 2.4.22+git0.f8e3218e2-150400.3.16.1
haproxy - addressed in versions 2.0.31-150100.8.34.1, 2.0.31-150200.11.23.1, 2.4.22+git0.f8e3218e2-150400.3.16.1
python-markupsafe (Red Hat package) - update to 2.1.1-4.el9
conmon (Red Hat package) - update to 2.1.7-1.2.rhaos4.14.el9
python-werkzeug (Red Hat package) - update to 2.2.3-2.el9
haproxy (Debian package) - addressed in versions 2.2.9-2+deb11u6, 2.6.12-1+deb12u1
haproxy - update to 2.2.16-5
haproxy-debugsource - update to 2.2.16-5
haproxy-debuginfo - update to 2.2.16-5
haproxy-help - update to 2.2.16-5
haproxy (Red Hat package) - addressed in versions 2.2.24-4.rhaos4.11.el8, 2.2.24-4.rhaos4.12.el8, 2.2.24-4.rhaos4.13.el8, 2.4.17-6.el9_2.2, 2.4.22-3.el9_3, 2.6.13-2.rhaos4.14.el8
haproxy - addressed in versions 2.4.22-3.0.1, 2.7.10-1
haproxy-doc - update to 2.7.10-1
haproxy - update to 2.8.0-1
ignition (Red Hat package) - update to 2.16.2-2.rhaos4.15.el9
container-selinux (Red Hat package) - update to 2.228.1-1.rhaos4.15.el9
podman (Red Hat package) - update to 4.4.1-21.rhaos4.15.el9
openshift-clients (Red Hat package) - addressed in versions 4.12.0-202312200531.p0.gd4c9e3c.assembly.stream.el8, 4.12.0-202312200531.p0.gd4c9e3c.assembly.stream.el9, 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.12.0-202401021932.p0.g5c97f5b.assembly.stream.el8, 4.12.0-202401021932.p0.g5c97f5b.assembly.stream.el9, 4.14.0-202311161233.p0.gd548052.assembly.stream.el8, 4.14.0-202311161233.p0.gd548052.assembly.stream.el9, 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - update to 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9
openshift-ansible (Red Hat package) - update to 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9
kernel (Red Hat package) - addressed in versions 4.18.0-372.87.1.el8_6, 5.14.0-284.43.1.el9_2, 5.14.0-284.54.1.el9_2
kernel-rt (Red Hat package) - addressed in versions 4.18.0-372.87.1.rt7.247.el8_6, 5.14.0-284.43.1.rt14.328.el9_2, 5.14.0-284.54.1.rt14.339.el9_2
rust-afterburn (Red Hat package) - update to 5.4.3-2.rhaos4.15.el9
IBM Security Verify Access - update to 10.0.7.0
ostree (Red Hat package) - update to 2023.8-3.el9
rpm-ostree (Red Hat package) - update to 2024.2-1.el9

• https://www.haproxy.org/download/2.8/src/CHANGELOG
• https://www.haproxy.org/download/2.6/src/CHANGELOG
• https://cwe.mitre.org/data/definitions/436.html
• https://github.com/haproxy/haproxy/issues/2237
• https://www.haproxy.org/download/2.7/src/CHANGELOG
• https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856

• Multiple vulnerabilities in HAProxy
• Ubuntu update for haproxy
• Ubuntu update for haproxy
• SUSE update for haproxy
• SUSE update for haproxy
• penShift Container Platform 4.13 update for HAProxy
• SUSE update for haproxy
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.14
• Multiple vulnerabilities in IBM Security Verify Access
• Red Hat OpenShift Container Platform 4.12 update for haproxy
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• OpenShift Container Platform 4.11 update for haproxy
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• openEuler update for haproxy
• Red Hat Enterprise Linux 9.2 Extended Update Support update for haproxy
• Red Hat Enterprise Linux 9 update for haproxy
• Debian update for haproxy
• Amazon Linux AMI update for haproxy
• Anolis OS update for haproxy
• Anolis OS update for haproxy