The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3e8a21cd5b advisory.

    Security fix for CVE-2023-0056, CVE-2023-25725

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0053 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-0056:
    An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the     service. This issue could allow an authenticated remote attacker to run a specially crafted malicious     server in an OpenShift cluster. The biggest impact is to availability.

    CVE-2023-0836:
    An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before     2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the     connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to     configured FastCGI backends in an unexpected way.

    CVE-2023-25725:
    HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in     some situations, aka request smuggling. The HTTP header parsers in HAProxy may accept empty header field     names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after     being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because     the headers disappear before being parsed and processed, as if they had not been sent by the client. The     fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1325 advisory.

  - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to     crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

  - Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM)     attacks. (CVE-2022-3259)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

  - A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean     function could transform an invalid path such as a/../c:/b into the valid path c:\b. This     transformation of a relative (if invalid) path into an absolute path could enable a directory traversal     attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid)     path .\c:\b. (CVE-2022-41722)

  - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests. (CVE-2022-41723)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
    Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory     and disk files. This also affects form parsing in the net/http package with the Request methods FormFile,     FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented     as storing up to maxMemory bytes +10MB (reserved for non-file parts) in memory. File parts which cannot     be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file     parts is excessively large and can potentially open a denial of service vector on its own. However,     ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead,     part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In     addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small     request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts     for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory     bytes of memory consumption. Users should still be aware that this limit is high and may still be     hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form     parts into a single temporary file. The mime/multipart.File interface type's documentation states, If     stored on disk, the File's underlying concrete type will be an *os.File.. This is no longer the case when     a form contains more than one file part, due to this coalescing of parts into a single file. The previous     behavior of using distinct files for each form part may be reenabled with the environment variable     GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request     methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the     size of form data with http.MaxBytesReader. (CVE-2022-41725)

  - An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the     service. This issue could allow an authenticated remote attacker to run a specially crafted malicious     server in an OpenShift cluster. The biggest impact is to availability. (CVE-2023-0056)

  - A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that     contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to     unconfined. By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC)     is runtime/default, allowing users to disable seccomp for pods they can create and modify.
    (CVE-2023-0229)

  - A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to     replace a normal file in a volume with a symlink while exporting the volume, allowing for access to     arbitrary files on the host file system. (CVE-2023-0778)

  - Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart     form data parser will parse an unlimited number of parts, including file parts. Parts can be a small     amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request     can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or     `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. The amount     of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory     and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all     available workers. Version 2.2.3 contains a patch for this issue. (CVE-2023-25577)

  - HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in     some situations, aka request smuggling. The HTTP header parsers in HAProxy may accept empty header field     names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after     being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because     the headers disappear before being parsed and processed, as if they had not been sent by the client. The     fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31. (CVE-2023-25725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0727 advisory.

  - Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could     cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
    After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. (CVE-2022-2879)

  - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

  - An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the     service. This issue could allow an authenticated remote attacker to run a specially crafted malicious     server in an OpenShift cluster. The biggest impact is to availability. (CVE-2023-0056)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0727 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.3. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:0728

    Security Fix(es):

    * golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端 Oracle Linux 9 主機上有一個套件受到 ELSA-2023-1696 公告中提及的多個弱點影響。

  - 2.7.3 版之前的 HAProxy 可能允許繞過存取控制，因為在某些情況下會意外遺失 HTTP/1 標頭，即要求走私。HAProxy 中的 HTTP 標頭剖析器可能接受空白標頭欄位名稱，其可用於截斷 HTTP 標頭清單，因而使部分標頭在針對 HTTP/1.0 和 HTTP/1.1 剖析和處理後消失。而對於 HTTP/2 和 HTTP/3 的影響有限，因為標頭在剖析和處理之前就消失了，彷彿標頭不是由用戶端傳送的一樣。已修正版本是 2.7.3、2.6.9、2.5.12、2.4.22、2.2.29 和 2.0.31。(CVE-2023-25725)

  - 在 HAProxy 中發現不受控制的資源消耗弱點，此弱點可造成服務損毀。經驗證的遠端攻擊者可利用此弱點在 OpenShift 叢集中執行特製的惡意伺服器。此弱點主要影響可用性。(CVE-2023-0056)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 9 主機上安裝的套件受到 RHSA-2023: 1978 公告中提及的弱點影響。

  - 在 HAProxy 中發現不受控制的資源消耗弱點，此弱點可造成服務損毀。經驗證的遠端攻擊者可利用此弱點在 OpenShift 叢集中執行特製的惡意伺服器。此弱點主要影響可用性。(CVE-2023-0056)

  - 2.7.3 版之前的 HAProxy 可能允許繞過存取控制，因為在某些情況下會意外遺失 HTTP/1 標頭，即要求走私。HAProxy 中的 HTTP 標頭剖析器可能接受空白標頭欄位名稱，其可用於截斷 HTTP 標頭清單，因而使部分標頭在針對 HTTP/1.0 和 HTTP/1.1 剖析和處理後消失。而對於 HTTP/2 和 HTTP/3 的影響有限，因為標頭在剖析和處理之前就消失了，彷彿標頭不是由用戶端傳送的一樣。已修正版本是 2.7.3、2.6.9、2.5.12、2.4.22、2.2.29 和 2.0.31。(CVE-2023-25725)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 20.04 LTS/22.04 LTS 主機上安裝的套件受到 USN-5819-1 公告中所提及的一個弱點影響。

  - 在 HAProxy 中發現不受控制的資源消耗弱點，此弱點可造成服務損毀。經驗證的遠端攻擊者可利用此弱點在 OpenShift 叢集中執行特製的惡意伺服器。此弱點主要影響可用性。(CVE-2023-0056)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 11 主機上安裝的多個套件受到 dsa-5348 公告中提及的多個弱點影響。

  - 2.7.3 版之前的 HAProxy 可能允許繞過存取控制，因為在某些情況下會意外遺失 HTTP/1 標頭，即要求走私。HAProxy 中的 HTTP 標頭剖析器可能接受空白標頭欄位名稱，其可用於截斷 HTTP 標頭清單，因而使部分標頭在針對 HTTP/1.0 和 HTTP/1.1 剖析和處理後消失。而對於 HTTP/2 和 HTTP/3 的影響有限，因為標頭在剖析和處理之前就消失了，彷彿標頭不是由用戶端傳送的一樣。已修正版本是 2.7.3、2.6.9、2.5.12、2.4.22、2.2.29 和 2.0.31。(CVE-2023-25725)

  - 在 HAProxy 中發現不受控制的資源消耗弱點，此弱點可造成服務損毀。經驗證的遠端攻擊者可利用此弱點在 OpenShift 叢集中執行特製的惡意伺服器。此弱點主要影響可用性。(CVE-2023-0056)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
171907	Fedora 37 : haproxy (2023-3e8a21cd5b)	Nessus	Fedora Local Security Checks	2023/2/25	2024/11/14	critical
236024	Alibaba Cloud Linux 3 : 0053: haproxy (ALINUX3-SA-2024:0053)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
189426	RHCOS 4 : OpenShift Container Platform 4.13.0 (RHSA-2023:1325)	Nessus	Red Hat Local Security Checks	2024/1/24	2024/1/24	critical
189451	RHCOS 4 : OpenShift Container Platform 4.12.3 (RHSA-2023:0727)	Nessus	Red Hat Local Security Checks	2024/1/24	2024/1/24	high
194193	RHEL 8 / 9 : OpenShift Container Platform 4.12.3 (RHSA-2023:0727)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	high
174143	Oracle Linux 9：haproxy (ELSA-2023-1696)	Nessus	Oracle Linux Local Security Checks	2023/4/12	2024/10/22	critical
174727	RHEL 9：haproxy (RHSA-2023: 1978)	Nessus	Red Hat Local Security Checks	2023/4/25	2024/11/7	critical
170417	Ubuntu 20.04 LTS / 22.04 LTS：HAProxy 弱點 (USN-5819-1)	Nessus	Ubuntu Local Security Checks	2023/1/23	2024/8/27	medium
171500	Debian DSA-5348-1：haproxy - 安全性更新	Nessus	Debian Local Security Checks	2023/2/15	2023/9/4	critical

検出

プラグインの検索

critical

critical

critical

high

high

critical

critical

medium

critical