Incomplete Cleanup Affecting haproxy package, versions <2.2.9-2+deb11u5
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-HAPROXY-3372396
- published 25 Mar 2023
- disclosed 29 Mar 2023
Introduced: 25 Mar 2023
CVE-2023-0836 Open this link in a new tabHow to fix?
Upgrade Debian:11 haproxy to version 2.2.9-2+deb11u5 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream haproxy package and not the haproxy package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.