Security update for haproxy SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:3288-1 Final 1 1 2019-12-12T14:52:10Z current 2019-12-12T14:52:10Z 2019-12-12T14:52:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for haproxy This update for haproxy fixes the following issues: - CVE-2019-18277: Fixed HTTP smuggling in messages with transfer-encoding header missing the 'chunked' value (bsc#1154980). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2019-3288,SUSE-2019-3288,SUSE-OpenStack-Cloud-7-2019-3288,SUSE-OpenStack-Cloud-8-2019-3288,SUSE-OpenStack-Cloud-9-2019-3288,SUSE-OpenStack-Cloud-Crowbar-8-2019-3288,SUSE-OpenStack-Cloud-Crowbar-9-2019-3288,SUSE-SLE-HA-12-SP3-2019-3288,SUSE-SLE-HA-12-SP4-2019-3288,SUSE-SLE-HA-12-SP5-2019-3288 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20193288-1/ Link for SUSE-SU-2019:3288-1 https://lists.suse.com/pipermail/sle-security-updates/2019-December/006251.html E-Mail link for SUSE-SU-2019:3288-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1154980 SUSE Bug 1154980 https://www.suse.com/security/cve/CVE-2019-18277/ SUSE CVE CVE-2019-18277 page HPE Helion OpenStack 8 SUSE Linux Enterprise High Availability Extension 12 SP3 SUSE Linux Enterprise High Availability Extension 12 SP4 SUSE Linux Enterprise High Availability Extension 12 SP5 SUSE OpenStack Cloud 7 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 haproxy-1.6.11-11.3.1 haproxy-1.6.11-11.3.1 as a component of HPE Helion OpenStack 8 haproxy-1.6.11-11.3.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP3 haproxy-1.6.11-11.3.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP4 haproxy-1.6.11-11.3.1 as a component of SUSE Linux Enterprise High Availability Extension 12 SP5 haproxy-1.6.11-11.3.1 as a component of SUSE OpenStack Cloud 7 haproxy-1.6.11-11.3.1 as a component of SUSE OpenStack Cloud 8 haproxy-1.6.11-11.3.1 as a component of SUSE OpenStack Cloud 9 haproxy-1.6.11-11.3.1 as a component of SUSE OpenStack Cloud Crowbar 8 haproxy-1.6.11-11.3.1 as a component of SUSE OpenStack Cloud Crowbar 9 A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification). CVE-2019-18277 HPE Helion OpenStack 8:haproxy-1.6.11-11.3.1 SUSE Linux Enterprise High Availability Extension 12 SP3:haproxy-1.6.11-11.3.1 SUSE Linux Enterprise High Availability Extension 12 SP4:haproxy-1.6.11-11.3.1 SUSE Linux Enterprise High Availability Extension 12 SP5:haproxy-1.6.11-11.3.1 SUSE OpenStack Cloud 7:haproxy-1.6.11-11.3.1 SUSE OpenStack Cloud 8:haproxy-1.6.11-11.3.1 SUSE OpenStack Cloud 9:haproxy-1.6.11-11.3.1 SUSE OpenStack Cloud Crowbar 8:haproxy-1.6.11-11.3.1 SUSE OpenStack Cloud Crowbar 9:haproxy-1.6.11-11.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20193288-1/ https://www.suse.com/security/cve/CVE-2019-18277.html CVE-2019-18277 https://bugzilla.suse.com/1154980 SUSE Bug 1154980