vulnerability

Amazon Linux AMI 2: CVE-2023-25725: Security patch for haproxy2 (ALASHAPROXY2-2023-003)

Severity
9
CVSS
(AV:N/AC:L/Au:N/C:N/I:C/A:C)
Published
Feb 14, 2023
Added
Sep 28, 2023
Modified
Jan 30, 2025

Description

HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.

Solution(s)

amazon-linux-ami-2-upgrade-haproxy2amazon-linux-ami-2-upgrade-haproxy2-debuginfo
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.