HTTP Request Smuggling Affecting openshift-clients-redistributable package, versions <0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL8-OPENSHIFTCLIENTSREDISTRIBUTABLE-5563399
- published 15 Feb 2023
- disclosed 14 Feb 2023
Introduced: 14 Feb 2023
CVE-2023-25725 Open this link in a new tabHow to fix?
Upgrade RHEL:8 openshift-clients-redistributable to version 0:4.13.0-202303241616.p0.g92b1a3d.assembly.stream.el8 or higher.
This issue was patched in RHSA-2023:1325.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openshift-clients-redistributable package and not the openshift-clients-redistributable package as distributed by RHEL.
See How to fix? for RHEL:8 relevant fixed versions and status.
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.
References
- https://access.redhat.com/security/cve/CVE-2023-25725
- https://git.haproxy.org/?p=haproxy-2.7.git;a=commit;h=a0e561ad7f29ed50c473f5a9da664267b60d1112
- https://www.haproxy.org/
- https://lists.debian.org/debian-lts-announce/2023/02/msg00012.html
- https://www.debian.org/security/2023/dsa-5348
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPTJQHKUEU2PQ7RWFUYAFLAD4STEIKHU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JM5NCIBTHYDTLPY2UNC4HO2VAHHE6CJG/
- https://git.haproxy.org/?p=haproxy-2.7.git%3Ba=commit%3Bh=a0e561ad7f29ed50c473f5a9da664267b60d1112
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPTJQHKUEU2PQ7RWFUYAFLAD4STEIKHU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JM5NCIBTHYDTLPY2UNC4HO2VAHHE6CJG/