Security update for haproxy SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1776-1 Final 1 1 2015-09-25T13:22:07Z current 2015-09-25T13:22:07Z 2015-09-25T13:22:07Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for haproxy haxproy was updated to backport various security fixes and related patches (bsc#937202) (bsc#937042) (CVE-2015-3281) + BUG/MAJOR: buffers: make the buffer_slow_realign() function respect output data + BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id + MEDIUM: ssl: replace standards DH groups with custom ones + BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value being overwritten + MINOR: ssl: add a destructor to free allocated SSL ressources + BUG/MINOR: ssl: Display correct filename in error message + MINOR: ssl: load certificates in alphabetical order + BUG/MEDIUM: checks: fix conflicts between agent checks and ssl healthchecks + BUG/MEDIUM: ssl: force a full GC in case of memory shortage + BUG/MEDIUM: ssl: fix bad ssl context init can cause segfault in case of OOM. + BUG/MINOR: ssl: correctly initialize ssl ctx for invalid certificates + MINOR: ssl: add statement to force some ssl options in global. + MINOR: ssl: add fetchs 'ssl_c_der' and 'ssl_f_der' to return DER formatted certs Also the init script was fixed for the haproxy status checks (bsc#947204) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleclo50sp3-haproxy-12142 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151776-1/ Link for SUSE-SU-2015:1776-1 https://lists.suse.com/pipermail/sle-security-updates/2015-October/001635.html E-Mail link for SUSE-SU-2015:1776-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/937042 SUSE Bug 937042 https://bugzilla.suse.com/937202 SUSE Bug 937202 https://bugzilla.suse.com/947204 SUSE Bug 947204 https://www.suse.com/security/cve/CVE-2015-3281/ SUSE CVE CVE-2015-3281 page SUSE OpenStack Cloud 5 haproxy-1.5.4-12.1 haproxy-1.5.4-12.1 as a component of SUSE OpenStack Cloud 5 The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request. CVE-2015-3281 SUSE OpenStack Cloud 5:haproxy-1.5.4-12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151776-1/ https://www.suse.com/security/cve/CVE-2015-3281.html CVE-2015-3281 https://bugzilla.suse.com/937042 SUSE Bug 937042 https://bugzilla.suse.com/937202 SUSE Bug 937202