Medium: haproxy

Issue Overview:

HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other “hdr_*” functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.

Affected Packages:

haproxy

Issue Correction:
Run yum update haproxy to update your system.

New Packages:

i686:  
    haproxy-1.4.22-5.3.amzn1.i686  
    haproxy-debuginfo-1.4.22-5.3.amzn1.i686  
  
src:  
    haproxy-1.4.22-5.3.amzn1.src  
  
x86_64:  
    haproxy-debuginfo-1.4.22-5.3.amzn1.x86_64  
    haproxy-1.4.22-5.3.amzn1.x86_64  

Additional References

Red Hat: CVE-2013-2175

Mitre: CVE-2013-2175