Skip to navigation

Security Advisory Moderate: haproxy security update

Advisory: RHSA-2013:0868-1
Type: Security Advisory
Severity: Moderate
Issued on: 2013-05-28
Last updated on: 2013-05-28
Affected Products: Red Hat Enterprise Linux Load Balancer (v. 6)
Red Hat Enterprise Linux Load Balancer EUS (v. 6.4.z)
CVEs (cve.mitre.org): CVE-2013-1912

Details

An updated haproxy package that fixes one security issue is now available
for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

HAProxy provides high availability, load balancing, and proxying for TCP
and HTTP-based applications.

A buffer overflow flaw was found in the way HAProxy handled pipelined HTTP
requests. A remote attacker could send pipelined HTTP requests that would
cause HAProxy to crash or, potentially, execute arbitrary code with the
privileges of the user running HAProxy. This issue only affected systems
using all of the following combined configuration options: HTTP keep alive
enabled, HTTP keywords in TCP inspection rules, and request appending
rules. (CVE-2013-1912)

Red Hat would like to thank Willy Tarreau of HAProxy upstream for reporting
this issue. Upstream acknowledges Yves Lafon from the W3C as the original
reporter.

HAProxy is released as a Technology Preview in Red Hat Enterprise Linux 6.
More information about Red Hat Technology Previews is available at
https://access.redhat.com/support/offerings/techpreview/

All users of haproxy are advised to upgrade to this updated package, which
contains a backported patch to correct this issue.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

Red Hat Enterprise Linux Load Balancer (v. 6)

SRPMS:
haproxy-1.4.22-4.el6_4.src.rpm
File outdated by:  RHSA-2013:1120
    MD5: ba1e5dfcf41b90af0c0ac332226d0686
SHA-256: 2f8bb0b676c39b8375ae38fcbdd0f9aace03e4e53971faa4c0dcb3ffdbbcd990
 
IA-32:
haproxy-1.4.22-4.el6_4.i686.rpm
File outdated by:  RHBA-2013:1619
    MD5: 361c0b2cd30c893ca8d522f091dabf64
SHA-256: 86b148aabac49660558a17abecf61bce0aaa9b041174fcc6f2bd0a49d6396290
haproxy-debuginfo-1.4.22-4.el6_4.i686.rpm
File outdated by:  RHBA-2013:1619
    MD5: d6655e5da424d3bb96b06d2adbdb81ff
SHA-256: 0859a4c9c15286a8bcf8ba1515685ef5647e763261664312a4a5ea894f5b0c16
 
x86_64:
haproxy-1.4.22-4.el6_4.x86_64.rpm
File outdated by:  RHBA-2013:1619
    MD5: ae37862d17e9ebd064e99f8421eeacba
SHA-256: d8de435741e64f8b7eb086105a440b2021db91ed29cabb3256926381c622e988
haproxy-debuginfo-1.4.22-4.el6_4.x86_64.rpm
File outdated by:  RHBA-2013:1619
    MD5: f8870c820236312c3cf58c0d479a097b
SHA-256: b95d93d8d145f76003d40ddc8bf395224a09609785bde1368d3a856c46cfdf02
 
Red Hat Enterprise Linux Load Balancer EUS (v. 6.4.z)

SRPMS:
haproxy-1.4.22-4.el6_4.src.rpm
File outdated by:  RHSA-2013:1120
    MD5: ba1e5dfcf41b90af0c0ac332226d0686
SHA-256: 2f8bb0b676c39b8375ae38fcbdd0f9aace03e4e53971faa4c0dcb3ffdbbcd990
 
IA-32:
haproxy-1.4.22-4.el6_4.i686.rpm
File outdated by:  RHSA-2013:1120
    MD5: 361c0b2cd30c893ca8d522f091dabf64
SHA-256: 86b148aabac49660558a17abecf61bce0aaa9b041174fcc6f2bd0a49d6396290
haproxy-debuginfo-1.4.22-4.el6_4.i686.rpm
File outdated by:  RHSA-2013:1120
    MD5: d6655e5da424d3bb96b06d2adbdb81ff
SHA-256: 0859a4c9c15286a8bcf8ba1515685ef5647e763261664312a4a5ea894f5b0c16
 
x86_64:
haproxy-1.4.22-4.el6_4.x86_64.rpm
File outdated by:  RHSA-2013:1120
    MD5: ae37862d17e9ebd064e99f8421eeacba
SHA-256: d8de435741e64f8b7eb086105a440b2021db91ed29cabb3256926381c622e988
haproxy-debuginfo-1.4.22-4.el6_4.x86_64.rpm
File outdated by:  RHSA-2013:1120
    MD5: f8870c820236312c3cf58c0d479a097b
SHA-256: b95d93d8d145f76003d40ddc8bf395224a09609785bde1368d3a856c46cfdf02
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

947581 - CVE-2013-1912 haproxy: rewrite rules flaw can lead to arbitrary code execution


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/