USN-6530-1: HAProxy vulnerability

Releases

• Ubuntu 23.04
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• haproxy - fast and reliable load balancing reverse proxy

Details

It was discovered that HAProxy incorrectly handled URI components
containing the hash character (#). A remote attacker could possibly use
this issue to obtain sensitive information, or to bypass certain path_end
rules.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• haproxy - 2.6.9-1ubuntu1.2

Ubuntu 22.04

• haproxy - 2.4.22-0ubuntu0.22.04.3

Ubuntu 20.04

• haproxy - 2.0.31-0ubuntu0.3

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-45539

Related notices

• USN-6530-2: haproxy, haproxy-doc, vim-haproxy