CVE-2024-53008 Other in HAProxy 2.6
Remote attackers can bypass ACL restrictions via HTTP request smuggling to access restricted paths and obtain sensitive information in HAProxy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53008?
CVE-2024-53008 is a medium-severity vulnerability in HAProxy 2.6, published on 28 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.
Weakness: CWE-444
Which versions are affected by CVE-2024-53008?
1 open source package ship an affected version, including haproxy.
| Package | Affected | Fixed in |
|---|---|---|
haproxy Bitnami | From 2.6.0 | 2.9.10, 3.0.3 |
Linux distribution packages (4)
haproxy SUSE:Linux Enterprise High Availability Extension 15 SP6 | All versions | 2.8.11+git0.01c1056a4-150600.3.3.1 |
haproxy SUSE:Linux Micro 6.0 | All versions | 2.8.11+git0.01c1056a4-1.1 |
haproxy SUSE:Linux Micro 6.1 | All versions | 2.8.11+git0.01c1056a4-slfo.1.1_1.1 |
haproxy openSUSE:Leap 15.6 | All versions | 2.8.11+git0.01c1056a4-150600.3.3.1 |
How do I fix CVE-2024-53008?
Upgrade haproxy to a fixed version for your release line: 2.9.10 or 3.0.3.
Is CVE-2024-53008 being exploited?
There is no known exploitation of CVE-2024-53008 in the wild and no public exploit code.
Sources
Also known as BIT-haproxy-2024-53008, DEBIAN-CVE-2024-53008, GHSA-qq72-vh82-fwv9, OESA-2024-2545, OESA-2024-2546, OESA-2024-2547 and 6 more.