HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade haproxy | Mar 8, 2024 | Nov 28, 2023 |
| Alpine Linux | — | Upgrade haproxy | Mar 21, 2024 | Nov 28, 2023 |
| Amazon Linux Ami 2 | — | Upgrade haproxy2-debuginfoUpgrade haproxy2 | Jan 10, 2024 | Nov 28, 2023 |
| Amazon_linux_2023 | — | Upgrade haproxy-debugsourceUpgrade haproxy-debuginfoUpgrade haproxy | Feb 17, 2025 | Nov 28, 2023 |
| Debian | — | Upgrade haproxy | Dec 19, 2023 | Nov 28, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade haproxy | Mar 13, 2024 | Nov 28, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade haproxy | Jan 29, 2024 | Nov 28, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade haproxy | Jul 23, 2024 | Nov 28, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade haproxy | Feb 12, 2024 | Nov 28, 2023 |
| Oracle_linux | — | Upgrade haproxy | Mar 6, 2024 | Nov 28, 2023 |
| Redhat Openshift | — | Upgrade haproxy | Aug 1, 2024 | Nov 28, 2023 |
| Redhat_linux | — | Upgrade haproxy-debugsourceUpgrade haproxyUpgrade haproxy-debuginfo | Mar 6, 2024 | Nov 28, 2023 |
| Rocky_linux | — | Upgrade haproxy-debuginfoUpgrade haproxyUpgrade haproxy-debugsource | Nov 19, 2024 | Nov 28, 2023 |
| Suse | — | Upgrade haproxy | Dec 7, 2023 | Nov 28, 2023 |
| Ubuntu | — | Upgrade haproxy (Ubuntu Pro)Upgrade haproxy | Dec 6, 2023 | Nov 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub