Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-11469

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.

Published

2018-05-25T14:29:00.323

Last Modified

2024-11-21T03:43:25.837

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-200

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	haproxy	haproxy	≤ 1.8.9	Yes
Operating System	canonical	ubuntu_linux	18.04	Yes

References

http://www.securityfocus.com/bid/104347 Third Party Advisory, VDB Entry ([email protected])
https://access.redhat.com/errata/RHSA-2019:1436 ([email protected])
https://git.haproxy.org/?p=haproxy-1.8.git%3Ba=commit%3Bh=17514045e5d934dede62116216c1b016fe23dd06 ([email protected])
https://usn.ubuntu.com/3663-1/ Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/104347 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2019:1436 (af854a3a-2127-422b-91ae-364da2661108)
https://git.haproxy.org/?p=haproxy-1.8.git%3Ba=commit%3Bh=17514045e5d934dede62116216c1b016fe23dd06 (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/3663-1/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)