[arch-security] [ASA-201606-11] haproxy: denial of service
anthraxx at archlinux.org
Fri Jun 10 10:43:12 UTC 2016
Arch Linux Security Advisory ASA-201606-11
Date : 2016-06-10
CVE-ID : CVE-2016-5360
Package : haproxy
Type : denial of service
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package haproxy before version 1.6.5-4 is vulnerable to denial of
Upgrade to 1.6.5-4.
# pacman -Syu "haproxy>=1.6.5-4"
The problem has been fixed upstream but no release is available yet.
A problem has been discovered with the new field "rule_deny_status"
into struct http_txn, which is filled only by actions "http-request
deny" and "http-request tarpit". It's then used in the deny code path
to emit the proper error message, but is used uninitialized when the
deny comes from a "reqdeny" rule, causing random behaviours ranging
from returning a 200, an empty response, or crashing the process.
A remote attacker is able to use a specially crafted request to crash
the process resulting in denial of service.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security