Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 519
Alerts This Week
Warning Icon 1 519

Debian 11: DSA-4960-1 Critical: HAProxy Request Smuggling Issue

debian
Calendar Grey August 17, 2021
Debian Logo
Enhancing HAProxy's security against HTTP request smuggling requires upgrading to the latest version and configuring specific settings in your configuration file
Several vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which can result in HTTP request smuggling
Topics%20covered

Topics Covered

security advisory Debian attack configuration request smuggling HAProxy HTTP/2

Summary

Known workarounds are to disable HTTP/2 and set
"tune.h2.max-concurrent-streams" to 0 in the "global" section.

global
tune.h2.max-concurrent-streams 0

For the stable distribution (bullseye), these problems have been fixed in
version 2.2.9-2+deb11u1.

We recommend that you upgrade your haproxy packages.

For the detailed security status of haproxy please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/source-package/haproxy

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Package: haproxy
CVE ID: not yet assigned

Topics%20covered

Topics Covered

security advisory Debian attack configuration request smuggling HAProxy HTTP/2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.