Lucene search

[email protected]CVE-2023-0056

HistoryMar 23, 2023 - 9:15 p.m.

CVE-2023-0056

2023-03-2321:15:19

CWE-400

[email protected]

web.nvd.nist.gov

664

cve-2023-0056

vulnerability

haproxy

resource consumption

service crash

authenticated remote attacker

openshift cluster

nvd

availability

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.7%

JSON

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

Affected configurations

NVD

Node

haproxyhaproxyMatch-

redhatceph_storageMatch5.0

redhatsoftware_collectionsMatch-

Node

redhatenterprise_linuxMatch9.0

AND

redhatopenshift_container_platformMatch4.12

redhatopenshift_container_platform_for_ibm_linuxoneMatch4.12

redhatopenshift_container_platform_for_powerMatch4.12

redhatopenshift_container_platform_ibm_z_systemsMatch4.12

Node

redhatopenshift_container_platformMatch4.10arm64

redhatopenshift_container_platformMatch4.11arm64

redhatopenshift_container_platformMatch4.12arm64

Node

redhatenterprise_linuxMatch8.0

AND

redhatopenshift_container_platformMatch4.10

redhatopenshift_container_platform_for_ibm_linuxoneMatch4.10

redhatopenshift_container_platform_for_powerMatch4.10

redhatopenshift_container_platform_ibm_z_systemsMatch4.10

Node

redhatenterprise_linuxMatch8.0

AND

redhatopenshift_container_platformMatch4.11

redhatopenshift_container_platform_for_ibm_linuxoneMatch4.11

redhatopenshift_container_platform_for_powerMatch4.11

redhatopenshift_container_platform_ibm_z_systemsMatch4.11

Node

redhatenterprise_linuxMatch8.0

AND

redhatopenshift_container_platformMatch4.12

redhatopenshift_container_platform_for_ibm_linuxoneMatch4.12

redhatopenshift_container_platform_for_powerMatch4.12

redhatopenshift_container_platform_ibm_z_systemsMatch4.12

Node

fedoraprojectextra_packages_for_enterprise_linuxMatch8.0

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

CPENameOperatorVersion
haproxy:haproxyhaproxyeq-
redhat:ceph_storageredhat ceph storageeq5.0
redhat:software_collectionsredhat software collectionseq-

CPE	Name	Operator	Version
haproxy:haproxy	haproxy	eq	-
redhat:ceph_storage	redhat ceph storage	eq	5.0
redhat:software_collections	redhat software collections	eq	-

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "haproxy",
    "versions": [
      {
        "version": "unknown",
        "status": "affected"
      }
    ]
  }
]