Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #211697 > unrolled thread
| Started by | Martin <keine-eile@online.de> |
|---|---|
| First post | 2019-07-24 10:10 +0200 |
| Last post | 2019-07-24 11:20 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.debian.user
About haproxy and CVE-2019-14241 Martin <keine-eile@online.de> - 2019-07-24 10:10 +0200
Re: About haproxy and CVE-2019-14241 Reco <recoverym4n@enotuniq.net> - 2019-07-24 11:20 +0200
| From | Martin <keine-eile@online.de> |
|---|---|
| Date | 2019-07-24 10:10 +0200 |
| Subject | About haproxy and CVE-2019-14241 |
| Message-ID | <ynkvv-7VS-1@gated-at.bofh.it> |
Hi list, I've received an advisory issued by one of my client's CERT. It is about haproxy and CVE-2019-14241: "HAProxy contains a flaw in the htx_manage_client_side_cookies() function in proto_htx.c that is triggered when handling certain threads. This may allow a remote attacker to cause a denial of service." At MITRE, this CVE exists, but I did not get any about it from the DSA or oss-security list. Does one of you know about more this? Martin
[toc] | [next] | [standalone]
| From | Reco <recoverym4n@enotuniq.net> |
|---|---|
| Date | 2019-07-24 11:20 +0200 |
| Message-ID | <ynlBf-7O-5@gated-at.bofh.it> |
| In reply to | #211697 |
Hi. On Wed, Jul 24, 2019 at 10:05:49AM +0200, Martin wrote: > I've received an advisory issued by one of my client's CERT. It is about haproxy and CVE-2019-14241: > > "HAProxy contains a flaw in the htx_manage_client_side_cookies() function in proto_htx.c that is triggered when handling certain threads. This may allow a remote attacker to cause a denial of service." > > At MITRE, this CVE exists, but I did not get any about it from the DSA or oss-security list. Does one of you know about more this? [1] lists CVE-2019-14241 as "resolved". Presumably there was no DSA because Debian haproxy is not affected by this issue. As for the oss-security - reporting vulnerabilities there is merely a courtesy. Reporting a vulnerability to the upstream - that's a must. Reco [1] https://security-tracker.debian.org/tracker/source-package/haproxy
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web