Arch Linux Security Advisory ASA-201606-11 ========================================== Severity: Medium Date : 2016-06-10 CVE-ID : CVE-2016-5360 Package : haproxy Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package haproxy before version 1.6.5-4 is vulnerable to denial of service. Resolution ========== Upgrade to 1.6.5-4. # pacman -Syu "haproxy>=1.6.5-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A problem has been discovered with the new field "rule_deny_status" into struct http_txn, which is filled only by actions "http-request deny" and "http-request tarpit". It's then used in the deny code path to emit the proper error message, but is used uninitialized when the deny comes from a "reqdeny" rule, causing random behaviours ranging from returning a 200, an empty response, or crashing the process. Impact ====== A remote attacker is able to use a specially crafted request to crash the process resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-5360 http://www.openwall.com/lists/oss-security/2016/06/09/5 https://bugs.archlinux.org/task/49638