HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.
{ "binaries": [ { "binary_name": "haproxy", "binary_version": "1.6.3-1ubuntu0.3+esm1" }, { "binary_name": "haproxy-dbg", "binary_version": "1.6.3-1ubuntu0.3+esm1" }, { "binary_name": "haproxy-dbgsym", "binary_version": "1.6.3-1ubuntu0.3+esm1" }, { "binary_name": "haproxy-doc", "binary_version": "1.6.3-1ubuntu0.3+esm1" }, { "binary_name": "vim-haproxy", "binary_version": "1.6.3-1ubuntu0.3+esm1" } ], "ubuntu_priority": "medium", "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro" }
{ "binaries": [ { "binary_name": "haproxy", "binary_version": "1.8.8-1ubuntu0.13+esm2" }, { "binary_name": "haproxy-dbgsym", "binary_version": "1.8.8-1ubuntu0.13+esm2" }, { "binary_name": "haproxy-doc", "binary_version": "1.8.8-1ubuntu0.13+esm2" }, { "binary_name": "vim-haproxy", "binary_version": "1.8.8-1ubuntu0.13+esm2" } ], "ubuntu_priority": "medium", "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro" }
{ "binaries": [ { "binary_name": "haproxy", "binary_version": "2.0.31-0ubuntu0.3" }, { "binary_name": "haproxy-dbgsym", "binary_version": "2.0.31-0ubuntu0.3" }, { "binary_name": "haproxy-doc", "binary_version": "2.0.31-0ubuntu0.3" }, { "binary_name": "vim-haproxy", "binary_version": "2.0.31-0ubuntu0.3" } ], "ubuntu_priority": "medium", "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "haproxy", "binary_version": "2.4.22-0ubuntu0.22.04.3" }, { "binary_name": "haproxy-dbgsym", "binary_version": "2.4.22-0ubuntu0.22.04.3" }, { "binary_name": "haproxy-doc", "binary_version": "2.4.22-0ubuntu0.22.04.3" }, { "binary_name": "vim-haproxy", "binary_version": "2.4.22-0ubuntu0.22.04.3" } ], "ubuntu_priority": "medium", "availability": "No subscription required" }