Bug 905095 (CVE-2023-0056, CVE-2023-25950) – net-proxy/haproxy: multiple vulnerabilities

• Product: Gentoo Security
• Status: IN_PROGRESS ---

[Description John Helmert III 2023-04-26 03:14:17 UTC]

CVE-2023-25950

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

A 2.7 patch is referenced:

https://git.haproxy.org/?p=haproxy-2.7.git;a=commit;h=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46

Does this vulnerability affect older branches?

[Comment 1 John Helmert III 2023-04-26 03:18:33 UTC]

CVE-2023-0056 (https://access.redhat.com/security/cve/CVE-2023-0056):

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

... but, there's an upstream bug in haproxy:

https://github.com/haproxy/haproxy/issues/1972

Are we affected?

[Comment 2 Christian Ruppert (idl0r) 2023-04-26 06:55:39 UTC]

>Does this vulnerability affect older branches?
No

>Are we affected?
Some old versions are still in the repo. Waiting for stabilizing via bug 894526 and bug 900737

[Comment 3 John Helmert III 2023-05-01 03:54:27 UTC]

(In reply to Christian Ruppert (idl0r) from comment #2)
> >Does this vulnerability affect older branches?
> No
> 
> >Are we affected?
> Some old versions are still in the repo. Waiting for stabilizing via bug
> 894526 and bug 900737

So, what are the fixed versions for the purposes of this bug?