Test ID:	1.3.6.1.4.1.25623.1.1.10.2023.0320
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2023-0320)
Summary:	The remote host is missing an update for the 'haproxy' package(s) announced via the MGASA-2023-0320 advisory.
Description:	Summary: The remote host is missing an update for the 'haproxy' package(s) announced via the MGASA-2023-0320 advisory. Vulnerability Insight: Haproxy has fixed security and other issues in last upstream version 2.8.3 of branch 2.8 Default user access are now commented out to prevent local action possible exploit and prevent further rpmnew on future updates. Use a check script to have config check result in error log on failure. Fix corruption with non empty access log. Fixed major bug list: - quic: Really ignore malformed ACK frames - http-ana: Get a fresh trash buffer for each header value replacement - h3: reject header values containing invalid chars - http: reject any empty content-length header value (CVE-2023-40225) Fixed medium bug list: - quic: fix tasklet_wakeup loop on connection closing - stconn: Update stream expiration date on blocked sends - stconn: Wake applets on sending path if there is a pending shutdown - stconn: Don't block sends if there is a pending shutdown - h1-htx: Ensure chunked parsing with full output buffer - applet: Fix API for function to push new data in channels buffer - stconn: Report read activity when a stream is attached to front SC - applet: Report an error if applet request more room on aborted SC - stconn/stream: Forward shutdown on write timeout - stconn: Always update stream's expiration date after I/O - capabilities: enable support for Linux capabilities - sink: invalid server list in sink_new_from_logsrv() - log: improper use of logsrv->maxlen for buffer targets - quic: token IV was not computed using a strong secret - quic: missing check of dcid for init pkt including a token - quic: timestamp shared in token was using internal time clock - hlua_fcn/queue: bad pop_wait sequencing - listener: Acquire proxy's lock in relax_listener() if necessary - h3: Properly report a C-L header was found to the HTX start-line - h3: Be sure to handle fin bit on the last DATA frame - bwlim: Reset analyse expiration date when then channel analyse ends - quic: consume contig space on requeue datagram Affected Software/OS: 'haproxy' package(s) on Mageia 9. Solution: Please install the updated package(s). CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-40225 https://cwe.mitre.org/data/definitions/436.html https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856 https://github.com/haproxy/haproxy/issues/2237 https://www.haproxy.org/download/2.6/src/CHANGELOG https://www.haproxy.org/download/2.7/src/CHANGELOG https://www.haproxy.org/download/2.8/src/CHANGELOG
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.