haproxy: denial of service
| Package(s): | haproxy | CVE #(s): | CVE-2016-5360 | ||||||||||||
| Created: | June 10, 2016 | Updated: | June 29, 2016 | ||||||||||||
| Description: | From the Arch Linux advisory:
A problem has been discovered with the new field "rule_deny_status" into struct http_txn, which is filled only by actions "http-request deny" and "http-request tarpit". It's then used in the deny code path to emit the proper error message, but is used uninitialized when the deny comes from a "reqdeny" rule, causing random behaviours ranging from returning a 200, an empty response, or crashing the process. A remote attacker is able to use a specially crafted request to crash the process resulting in denial of service. | ||||||||||||||
| Alerts: |
| ||||||||||||||