OESA-2023-1141

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1141
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2023-1141.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2023-1141
Upstream
Published
2023-03-04T11:05:00Z
Modified
2025-08-12T05:16:41.588332Z
Summary
haproxy security update
Details

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

Initial description: Router PODs frequently getting restarted and haproxy process is receiving the segfault but it is not generating coredump even though the core file size is unlimited.

Upstream bug: https://github.com/haproxy/haproxy/issues/1972(CVE-2023-0056)

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.(CVE-2023-25725)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / haproxy

Package

Name
haproxy
Purl
pkg:rpm/openEuler/haproxy&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.16-4.oe1

Ecosystem specific 

{
    "aarch64": [
        "haproxy-debuginfo-2.2.16-4.oe1.aarch64.rpm",
        "haproxy-2.2.16-4.oe1.aarch64.rpm",
        "haproxy-debugsource-2.2.16-4.oe1.aarch64.rpm"
    ],
    "x86_64": [
        "haproxy-2.2.16-4.oe1.x86_64.rpm",
        "haproxy-debuginfo-2.2.16-4.oe1.x86_64.rpm",
        "haproxy-debugsource-2.2.16-4.oe1.x86_64.rpm"
    ],
    "noarch": [
        "haproxy-help-2.2.16-4.oe1.noarch.rpm"
    ],
    "src": [
        "haproxy-2.2.16-4.oe1.src.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / haproxy

Package

Name
haproxy
Purl
pkg:rpm/openEuler/haproxy&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.16-4.oe1

Ecosystem specific 

{
    "aarch64": [
        "haproxy-2.2.16-4.oe1.aarch64.rpm",
        "haproxy-debuginfo-2.2.16-4.oe1.aarch64.rpm",
        "haproxy-debugsource-2.2.16-4.oe1.aarch64.rpm"
    ],
    "x86_64": [
        "haproxy-2.2.16-4.oe1.x86_64.rpm",
        "haproxy-debuginfo-2.2.16-4.oe1.x86_64.rpm",
        "haproxy-debugsource-2.2.16-4.oe1.x86_64.rpm"
    ],
    "noarch": [
        "haproxy-help-2.2.16-4.oe1.noarch.rpm"
    ],
    "src": [
        "haproxy-2.2.16-4.oe1.src.rpm"
    ]
}

openEuler:22.03-LTS / haproxy

Package

Name
haproxy
Purl
pkg:rpm/openEuler/haproxy&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.6-2.oe2203sp1

Ecosystem specific 

{
    "aarch64": [
        "haproxy-debuginfo-2.4.8-3.oe2203.aarch64.rpm",
        "haproxy-2.4.8-3.oe2203.aarch64.rpm",
        "haproxy-debugsource-2.4.8-3.oe2203.aarch64.rpm",
        "haproxy-debugsource-2.6.6-2.oe2203sp1.aarch64.rpm",
        "haproxy-2.6.6-2.oe2203sp1.aarch64.rpm",
        "haproxy-debuginfo-2.6.6-2.oe2203sp1.aarch64.rpm"
    ],
    "x86_64": [
        "haproxy-2.4.8-3.oe2203.x86_64.rpm",
        "haproxy-debuginfo-2.4.8-3.oe2203.x86_64.rpm",
        "haproxy-debugsource-2.4.8-3.oe2203.x86_64.rpm",
        "haproxy-debuginfo-2.6.6-2.oe2203sp1.x86_64.rpm",
        "haproxy-2.6.6-2.oe2203sp1.x86_64.rpm",
        "haproxy-debugsource-2.6.6-2.oe2203sp1.x86_64.rpm"
    ],
    "noarch": [
        "haproxy-help-2.4.8-3.oe2203.noarch.rpm",
        "haproxy-help-2.6.6-2.oe2203sp1.noarch.rpm"
    ],
    "src": [
        "haproxy-2.4.8-3.oe2203.src.rpm",
        "haproxy-2.6.6-2.oe2203sp1.src.rpm"
    ]
}

openEuler:22.03-LTS-SP1 / haproxy

Package

Name
haproxy
Purl
pkg:rpm/openEuler/haproxy&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.6-2.oe2203sp1

Ecosystem specific 

{
    "aarch64": [
        "haproxy-debugsource-2.6.6-2.oe2203sp1.aarch64.rpm",
        "haproxy-2.6.6-2.oe2203sp1.aarch64.rpm",
        "haproxy-debuginfo-2.6.6-2.oe2203sp1.aarch64.rpm"
    ],
    "x86_64": [
        "haproxy-debuginfo-2.6.6-2.oe2203sp1.x86_64.rpm",
        "haproxy-2.6.6-2.oe2203sp1.x86_64.rpm",
        "haproxy-debugsource-2.6.6-2.oe2203sp1.x86_64.rpm"
    ],
    "noarch": [
        "haproxy-help-2.6.6-2.oe2203sp1.noarch.rpm"
    ],
    "src": [
        "haproxy-2.6.6-2.oe2203sp1.src.rpm"
    ]
}