CVE-2022-0711 Denial of service in haproxy
An attacker can cause a denial of service in HAProxy by sending crafted HTTP responses with Set-Cookie2 headers, triggering an infinite loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0711?
CVE-2022-0711 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 2 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
Weakness: CWE-835
Which versions are affected by CVE-2022-0711?
1 open source package ship an affected version, including haproxy. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
haproxy Bitnami | From 2.2.0 | 2.2.21, 2.3.18, 2.4.13 |
Linux distribution packages (14)
haproxy Red Hat:openshift:4.7::el7 | All versions | 0:2.0.19-3.el7 |
haproxy-debuginfo Red Hat:openshift:4.7::el7 | All versions | 0:2.0.19-3.el7 |
haproxy20 Red Hat:openshift:4.7::el7 | All versions | 0:2.0.19-3.el7 |
haproxy Red Hat:openshift:4.7::el8 | All versions | 0:2.0.19-3.el8 |
haproxy-debugsource Red Hat:openshift:4.7::el8 | All versions | 0:2.0.19-3.el8 |
haproxy20 Red Hat:openshift:4.7::el8 | All versions | 0:2.0.19-3.el8 |
haproxy20-debuginfo Red Hat:openshift:4.7::el8 | All versions | 0:2.0.19-3.el8 |
haproxy Red Hat:openshift:4.8::el8 | All versions | 0:2.2.13-3.el8 |
haproxy-debugsource Red Hat:openshift:4.8::el8 | All versions | 0:2.2.13-3.el8 |
haproxy22 Red Hat:openshift:4.8::el8 | All versions | 0:2.2.13-3.el8 |
haproxy22-debuginfo Red Hat:openshift:4.8::el8 | All versions | 0:2.2.13-3.el8 |
haproxy SUSE:Linux Enterprise High Availability Extension 15 SP4 | All versions | 2.4.8+git0.d1f8d41e0-150400.3.3.13 |
haproxy openSUSE:Leap 15.4 | All versions | 2.4.8+git0.d1f8d41e0-150400.3.3.13 |
haproxy openSUSE:Tumbleweed | All versions | 2.5.4+git0.e55ab4208-1.1 |
Products include Debian Debian Linux, Haproxy Haproxy, Redhat Enterprise Linux, Redhat Openshift Container Platform, Redhat Software Collections.
How do I fix CVE-2022-0711?
Upgrade haproxy to a fixed version for your release line: 2.2.21, 2.3.18 or 2.4.13.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-0711 being exploited?
There is no known exploitation of CVE-2022-0711 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-0711, AZL-8899, BIT-haproxy-2022-0711, DEBIAN-CVE-2022-0711, DSA-5102-1, GHSA-x4fc-x944-v9p7 and 8 more.