UbuntuUpdates.org

Package "haproxy"

Name: haproxy

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • fast and reliable load balancing reverse proxy (HTML documentation)
  • syntax highlighting for HAProxy configuration files

Latest version: 1.8.8-1ubuntu0.9
Release: bionic (18.04)
Level: security
Repository: universe

Links

Save this URL for the latest version of "haproxy": https://www.ubuntuupdates.org/haproxy



Other versions of "haproxy" in Bionic

Repository Area Version
base main 1.8.8-1
base universe 1.8.8-1
security main 1.8.8-1ubuntu0.9
updates main 1.8.8-1ubuntu0.9
updates universe 1.8.8-1ubuntu0.9

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.8.8-1ubuntu0.9 2019-12-05 01:07:26 UTC

  haproxy (1.8.8-1ubuntu0.9) bionic-security; urgency=medium

  * SECURITY UPDATE: Intermediary Encapsulation attacks
    - debian/patches/CVE-2019-19330-*.patch: reject header values containing
      invalid chars and make header field name filtering stronger in
      src/h2.c, include/common/ist.h, include/common/h2.h.
    - CVE-2019-19330

 -- <email address hidden> (Leonidas S. Barbosa) Mon, 02 Dec 2019 12:38:31 -0300

Source diff to previous version
CVE-2019-19330 The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa),

Version: 1.8.8-1ubuntu0.7 2019-11-05 14:06:22 UTC

  haproxy (1.8.8-1ubuntu0.7) bionic-security; urgency=medium

  * SECURITY UPDATE: Messages with transfer-encoding header missing "chunked"
    value were not being correctly rejected
    - debian/patches/CVE-2019-18277.patch: also reject messages where
      "chunked" is missing from transfer-enoding in.
      src/proto_http.c.
    - CVE-2019-18277

 -- <email address hidden> (Leonidas S. Barbosa) Mon, 04 Nov 2019 11:03:13 -0300

Source diff to previous version
CVE-2019-18277 A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being co

Version: 1.8.8-1ubuntu0.3 2019-01-15 13:06:39 UTC

  haproxy (1.8.8-1ubuntu0.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds read
    - debian/patches/CVE-2018-20102.patch: check the bounds
      in src/dns.c.
    - CVE-2018-20102
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2018-20103.patch: fix in
      src/dns.c.
    - CVE-2018-20103
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2018-20615.patch: fix in
      src/mux_h2.c.
    - CVE-2018-20615

 -- <email address hidden> (Leonidas S. Barbosa) Fri, 11 Jan 2019 11:06:19 -0300

Source diff to previous version
CVE-2018-20102 An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS resp
CVE-2018-20103 An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by m

Version: 1.8.8-1ubuntu0.2 2018-10-02 19:07:15 UTC

  haproxy (1.8.8-1ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2018-14645.patch: fix in include/common/hpack-tbl.h,
      src/hpack-dec.c, src/hpack-tbl.c.
    - CVE-2018-14645

 -- <email address hidden> (Leonidas S. Barbosa) Tue, 02 Oct 2018 08:32:44 -0300

Source diff to previous version
CVE-2018-14645 A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resu

Version: 1.8.8-1ubuntu0.1 2018-05-30 16:07:23 UTC

  haproxy (1.8.8-1ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Information disclosure
    - debian/patches/CVE-2018-11469.patch: fix in src/protp_http.c and
      adds some config notes.
    - CVE-2018-11469

 -- <email address hidden> (Leonidas S. Barbosa) Tue, 29 May 2018 16:29:29 -0300

CVE-2018-11469 Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to ac



About   -   Send Feedback to @ubuntu_updates