CVE-2023-40225

2023-08-1000:00:00

ubuntu.com

haproxy

vulnerability

content-length

rfc 9110

http/1

server

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

0.002 Low

EPSS

Percentile

54.0%

JSON

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x
through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and
2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC
9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may
interpret the payload as an extra request.

Bugs

<https://github.com/haproxy/haproxy/issues/2237>

Notes

Author	Note
rodrigo-zaiden	affected content-length headers parses were added in v1.9, with HTX mode. legacy mode in v2.0 and before has the correct check. hence, Ubuntu releases older than focal are not affected. there is a followup commit to handle a specific corner case where leading zeroes on content-length are being preserved, and a bogus server could take it as a prefix, that being commit 22731762. upstream stated that the leading zeroes situation can still happen in versions older than v1.9, it could be addressed in v2.0+ (with HTX) but it is not feasible for older versions due to the way values are indexed. (more information on bug link)

Author

Note

rodrigo-zaiden

affected content-length headers parses were added in v1.9, with HTX mode. legacy mode in v2.0 and before has the correct check. hence, Ubuntu releases older than focal are not affected. there is a followup commit to handle a specific corner case where leading zeroes on content-length are being preserved, and a bogus server could take it as a prefix, that being commit 22731762. upstream stated that the leading zeroes situation can still happen in versions older than v1.9, it could be addressed in v2.0+ (with HTX) but it is not feasible for older versions due to the way values are indexed. (more information on bug link)

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchhaproxy< 2.0.31-0ubuntu0.2UNKNOWN
ubuntu22.04noarchhaproxy< 2.4.22-0ubuntu0.22.04.2UNKNOWN
ubuntu23.04noarchhaproxy< 2.6.9-1ubuntu1.1UNKNOWN
ubuntu23.10noarchhaproxy< 2.6.15-1ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	haproxy	< 2.0.31-0ubuntu0.2	UNKNOWN
ubuntu	22.04	noarch	haproxy	< 2.4.22-0ubuntu0.22.04.2	UNKNOWN
ubuntu	23.04	noarch	haproxy	< 2.6.9-1ubuntu1.1	UNKNOWN
ubuntu	23.10	noarch	haproxy	< 2.6.15-1ubuntu1	UNKNOWN