Vulnerabilities > CVE-2023-0836 - Incomplete Cleanup vulnerability in Haproxy

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

haproxy

CWE-459

NVD

Published: 2023-03-29

Updated: 2023-11-07

Summary

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

Vulnerable Configurations

Part	Description	Count
Application	Haproxy Haproxy Haproxy 2.7.0 Haproxy Haproxy 2.6.0 Haproxy Haproxy 2.6.1 Haproxy Haproxy 2.6.2 Haproxy Haproxy 2.6.3 Haproxy Haproxy 2.6.4 Haproxy Haproxy 2.6.5 Haproxy Haproxy 2.6.6 Haproxy Haproxy 2.6.7 Haproxy Haproxy 2.6.8 Haproxy Haproxy 2.5.0 Haproxy Haproxy 2.5.1 Haproxy Haproxy 2.5.2 Haproxy Haproxy 2.5.3 Haproxy Haproxy 2.5.4 Haproxy Haproxy 2.5.5 Haproxy Haproxy 2.5.6 Haproxy Haproxy 2.5.7 Haproxy Haproxy 2.5.8 Haproxy Haproxy 2.5.9 Haproxy Haproxy 2.5.10 Haproxy Haproxy 2.5.11 Haproxy Haproxy 2.4.0 Haproxy Haproxy 2.4.1 Haproxy Haproxy 2.4.2 Haproxy Haproxy 2.4.3 Haproxy Haproxy 2.4.4 Haproxy Haproxy 2.4.5 Haproxy Haproxy 2.4.6 Haproxy Haproxy 2.4.7 Haproxy Haproxy 2.4.8 Haproxy Haproxy 2.4.9 Haproxy Haproxy 2.4.10 Haproxy Haproxy 2.4.11 Haproxy Haproxy 2.4.12 Haproxy Haproxy 2.4.13 Haproxy Haproxy 2.4.14 Haproxy Haproxy 2.4.15 Haproxy Haproxy 2.4.16 Haproxy Haproxy 2.4.17 Haproxy Haproxy 2.4.18 Haproxy Haproxy 2.4.19 Haproxy Haproxy 2.4.20 Haproxy Haproxy 2.4.21 Haproxy Haproxy 2.3.0 Haproxy Haproxy 2.2.0 Haproxy Haproxy 2.2.1 Haproxy Haproxy 2.2.2 Haproxy Haproxy 2.2.3 Haproxy Haproxy 2.2.4 Haproxy Haproxy 2.2.5 Haproxy Haproxy 2.2.6 Haproxy Haproxy 2.2.7 Haproxy Haproxy 2.2.8 Haproxy Haproxy 2.2.9 Haproxy Haproxy 2.2.10 Haproxy Haproxy 2.2.11 Haproxy Haproxy 2.2.12 Haproxy Haproxy 2.2.13 Haproxy Haproxy 2.2.14 Haproxy Haproxy 2.2.15 Haproxy Haproxy 2.2.16 Haproxy Haproxy 2.2.17 Haproxy Haproxy 2.2.18 Haproxy Haproxy 2.2.19 Haproxy Haproxy 2.2.20 Haproxy Haproxy 2.2.21 Haproxy Haproxy 2.2.22 Haproxy Haproxy 2.2.23 Haproxy Haproxy 2.2.24 Haproxy Haproxy 2.2.25 Haproxy Haproxy 2.2.26 Haproxy Haproxy 2.1.0	73

Common Weakness Enumeration (CWE)

CWE-459 - Incomplete Cleanup

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References