CVE-2023-0836
29.03.2023, 21:15
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.Enginsight
| Vendor | Product | Version |
|---|---|---|
| haproxy | haproxy | 2.2.0 ≤ 𝑥 < 2.2.27 |
| haproxy | haproxy | 2.4.0 ≤ 𝑥 ≤ 2.4.21 |
| haproxy | haproxy | 2.5.0 ≤ 𝑥 ≤ 2.5.11 |
| haproxy | haproxy | 2.6.0 ≤ 𝑥 ≤ 2.6.8 |
| haproxy | haproxy | 2.1.0 |
| haproxy | haproxy | 2.3.0 |
| haproxy | haproxy | 2.7.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-459 - Incomplete CleanupThe software does not properly "clean up" and remove temporary or supporting resources after they have been used.