CVE-2023-25725
haproxy - security update
Description
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.
How to fix CVE-2023-25725
To remediate CVE-2023-25725, upgrade the affected package to a fixed version below.
- —upgrade to 2.0.31 or later
- —upgrade to 2.2.9-2+deb11u4 or later
- —upgrade to 1.8.19-1+deb10u4 or later
Is CVE-2023-25725 being exploited?
Moderate — EPSS is 17.5%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (3)
- from 0, < 2.0.31, >= 2.1.0, < 2.2.29, >= 2.3.0, < 2.4.22, >= 2.5.0, < 2.5.12, >= 2.6.0, < 2.6.9, >= 2.7.0, < 2.7.3
- from 0, < 2.2.9-2+deb11u4
- from 0, < 1.8.19-1+deb10u4
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |