Information Exposure Affecting haproxy package, versions <2.4.18-0ubuntu1.3


Severity

Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0% (1st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2204-HAPROXY-5291344
  • published27 Mar 2023
  • disclosed29 Mar 2023

Introduced: 27 Mar 2023

CVE-2023-0836  (opens in a new tab)
CWE-200  (opens in a new tab)
CWE-459  (opens in a new tab)

How to fix?

Upgrade Ubuntu:22.04 haproxy to version 2.4.18-0ubuntu1.3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream haproxy package and not the haproxy package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

CVSS Base Scores

version 3.1