CVE-2019-18277
Summary
| CVE | CVE-2019-18277 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-10-23 14:15:00 UTC |
| Updated | 2023-11-07 03:06:00 UTC |
| Description | A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification). |
Risk And Classification
Problem Types: CWE-444
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Repositories - haproxy-2.0.git/commit | MISC | git.haproxy.org | Patch, Vendor Advisory |
| HAProxy HTTP request smuggling - My Blog | MISC | nathandavison.com | Exploit, Third Party Advisory |
| [ANNOUNCE] haproxy-2.0.6 | www.mail-archive.com | ||
| [SECURITY] [DLA 3034-1] haproxy security update | MLIST | lists.debian.org | |
| Repositories - haproxy-2.0.git/commit | git.haproxy.org | ||
| [security-announce] openSUSE-SU-2019:2626-1: important: Security update | SUSE | lists.opensuse.org | |
| [security-announce] openSUSE-SU-2019:2645-1: important: Security update | SUSE | lists.opensuse.org | |
| [ANNOUNCE] haproxy-2.0.6 | MISC | www.mail-archive.com | Release Notes |
| USN-4174-1: HAproxy vulnerability | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.