Issued:
2015-09-08
Updated:
2015-09-08

RHSA-2015:1741 - Important: haproxy security update

Synopsis

Important: haproxy security update

Type/Severity

Security Advisory Important

Topic

An updated haproxy package that fixes one security issue is now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Description

HAProxy provides high availability, load balancing, and proxying for TCP and HTTP-based applications.

An implementation error related to the memory management of request and responses was found within HAProxy's buffer_slow_realign() function. An unauthenticated remote attacker could possibly use this flaw to leak certain memory buffer contents from a past request or session. (CVE-2015-3281)

All haproxy users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

ProductVersionArch
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions7.7x86_64
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions7.6x86_64
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions7.4x86_64
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions7.3x86_64
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions7.2x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support7.7x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support7.6x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support7.5x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support7.4x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support7.3x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support7.2x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support7.1x86_64
Red Hat Enterprise Linux Workstation7x86_64
Red Hat Enterprise Linux Server7x86_64
Red Hat Enterprise Linux Server from RHUI7x86_64
Red Hat Enterprise Linux Server - TUS7.7x86_64
Red Hat Enterprise Linux Server - TUS7.6x86_64
Red Hat Enterprise Linux Server - TUS7.3x86_64
Red Hat Enterprise Linux Server - Extended Life Cycle Support7x86_64
Red Hat Enterprise Linux Server - AUS7.7x86_64
Red Hat Enterprise Linux Server - AUS7.6x86_64
Red Hat Enterprise Linux Server - AUS7.4x86_64
Red Hat Enterprise Linux Server - AUS7.3x86_64
Red Hat Enterprise Linux Load Balancer (for RHEL Server)6x86_64
Red Hat Enterprise Linux Load Balancer (for RHEL Server)6i386
Red Hat Enterprise Linux Load Balancer (for RHEL Server) from RHUI6x86_64
Red Hat Enterprise Linux Load Balancer (for RHEL Server) from RHUI6i386
Red Hat Enterprise Linux Load Balancer (for RHEL Server) - Extended Update Support6.7x86_64
Red Hat Enterprise Linux Load Balancer (for RHEL Server) - Extended Update Support6.7i386

Updated Packages

  • haproxy-1.5.4-2.el6_7.1.i686.rpm
  • haproxy-1.5.4-4.el7_1.1.x86_64.rpm
  • haproxy-debuginfo-1.5.4-4.el7_1.1.x86_64.rpm
  • haproxy-1.5.4-2.el6_7.1.x86_64.rpm
  • haproxy-debuginfo-1.5.4-2.el6_7.1.x86_64.rpm
  • haproxy-debuginfo-1.5.4-2.el6_7.1.i686.rpm
  • haproxy-1.5.4-2.el6_7.1.src.rpm

Fixes

CVEs

References

Additional information