CVE-2023-0836

highPriorität · verfolgen · 30EPSS 0.012 · 68. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.20% (68th) EPSS

CVSS 7.5 · high

Is it mine?

47 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenhaproxy-0:2.4.22-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-0:2.4.22-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-0:2.4.22-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-0:2.4.22-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-0:2.4.22-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-debuginfo-0:2.4.22-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-debuginfo-0:2.4.22-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-debuginfo-0:2.4.22-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-debuginfo-0:2.4.22-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-debugsource-0:2.4.22-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-debugsource-0:2.4.22-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-debugsource-0:2.4.22-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496
Behobenhaproxy-debugsource-0:2.4.22-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:6496

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NsecondaryAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · Red Hat Product Security US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-200USCWE-459USCWE-459USCWE-459US

betroffene Produkte (47)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Ubuntu Linuxalle Versionencert_bundDEcpe:/o:canonical:ubuntu_linux:-
n/a haproxy≤ HAProxy 2.8, HAProxy 2.7.1, HAProxy 2.6.8, HAProxy 2.5.11, HAProxy 2.4.21, HAProxy 2.2.27enisa_euvdEU
Willy Terreau HAProxy≤ 2.7.0fstec_bduRU
Willy Terreau HAProxy≤ 2.3.0fstec_bduRU
Willy Terreau HAProxy≤ 2.1.0fstec_bduRU
Willy Terreau HAProxy2.2.0 → 2.2.27fstec_bduRU
Willy Terreau HAProxy2.4.0 → 2.4.21fstec_bduRU
Willy Terreau HAProxy2.5.0 → 2.5.11fstec_bduRU
Willy Terreau HAProxy2.6.0 → 2.6.8fstec_bduRU
АО «ИВК» АЛЬТ СП 10alle Versionenfstec_bduRU
АО «НТЦ ИТ РОСА» РОСА ХРОМ≤ 12.4fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.6 «Смоленск»fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 4.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition для «Эльбрус»≤ 8.1 «Ленинград»fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU

20 von 47 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2023:6496Red Hat Security Advisory: haproxy security and bug fix update2023-11-07csaf · redhat_csafUS
An update for haproxy is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2023-0716HAProxy Enterprise: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2023-03-22csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HAProxy Enterprise ausnutzen, um Informationen offenzulegen.
BIT-haproxy-2023-08362024-03-06vendor · osvUS
An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund redhat_csaf osv NVD CVE.org MITRE

veröffentlicht 2023-03-29geändert 2026-06-17

Referenzen (9)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan