Description
Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
HAProxy Project HAProxy 2.6
2.6.18 and earlieraffected
HAProxy Project HAProxy 2.8
2.8.10 and earlieraffected
HAProxy Project HAProxy 2.9
2.9.9 and earlieraffected
HAProxy Project HAProxy 3.0
3.0.2 and earlieraffected
References
- https://www.haproxy.org/ ↗
- https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=1afca10150ac3e4e2224055cc31b6f1e4a70efe2 ↗
- https://git.haproxy.org/?p=haproxy-2.8.git;a=commit;h=01c1056a44823c5ffb8f74660b32c099d9b5355b ↗
- https://git.haproxy.org/?p=haproxy-2.9.git;a=commit;h=4bcaece344c8738dac1ab5bd8cc81e2a22701d71 ↗
- https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=95a607c4b3af09be2a495b9c2872ea252ccff603 ↗
- https://jvn.jp/en/jp/JVN88385716/ ↗