{
  "threat_severity" : "Moderate",
  "public_date" : "2023-08-10T00:00:00Z",
  "bugzilla" : {
    "description" : "haproxy: Proxy forwards malformed empty Content-Length headers",
    "id" : "2231370",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2231370"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-20",
  "details" : [ "HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.", "A flaw was found in HAProxy. Empty Content-Length headers are forwarded, which could cause an HTTP/1 server behind it to interpret the payload as an extra request. This may render the HTTP/1 server vulnerable to attacks in some uncommon cases." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-03-05T00:00:00Z",
    "advisory" : "RHSA-2024:1142",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "haproxy-0:2.4.22-3.el9_3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-03-05T00:00:00Z",
    "advisory" : "RHSA-2024:1089",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2",
    "package" : "haproxy-0:2.4.17-6.el9_2.2"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.11",
    "release_date" : "2024-01-25T00:00:00Z",
    "advisory" : "RHSA-2024:0308",
    "cpe" : "cpe:/a:redhat:openshift:4.11::el8",
    "package" : "haproxy-0:2.2.24-4.rhaos4.11.el8"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.12",
    "release_date" : "2024-01-17T00:00:00Z",
    "advisory" : "RHSA-2024:0200",
    "cpe" : "cpe:/a:redhat:openshift:4.12::el8",
    "package" : "haproxy-0:2.2.24-4.rhaos4.12.el8"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.13",
    "release_date" : "2023-12-06T00:00:00Z",
    "advisory" : "RHSA-2023:7606",
    "cpe" : "cpe:/a:redhat:openshift:4.13::el8",
    "package" : "haproxy-0:2.2.24-4.rhaos4.13.el8"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.14",
    "release_date" : "2023-11-29T00:00:00Z",
    "advisory" : "RHSA-2023:7473",
    "cpe" : "cpe:/a:redhat:openshift:4.14::el8",
    "package" : "haproxy-0:2.6.13-2.rhaos4.14.el8"
  } ],
  "package_state" : [ {
    "product_name" : "Cryostat 2",
    "fix_state" : "Not affected",
    "package_name" : "haproxy",
    "cpe" : "cpe:/a:redhat:cryostat:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 5",
    "fix_state" : "Out of support scope",
    "package_name" : "haproxy",
    "cpe" : "cpe:/a:redhat:ceph_storage:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "haproxy",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "haproxy",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "haproxy",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Out of support scope",
    "package_name" : "haproxy",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat Software Collections",
    "fix_state" : "Will not fix",
    "package_name" : "rh-haproxy18-haproxy",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-40225\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-40225" ],
  "name" : "CVE-2023-40225",
  "mitigation" : {
    "value" : "This flaw can be mitigated by applying a rule to explicitly reject any requests with an empty Content-Lenght header. The following line can be added to any frontend configurations at the /etc/haproxy/haproxy.cfg file.  \n~~~\nhttp-request deny if { hdr_len(content-length) 0 }\n~~~",
    "lang" : "en:us"
  },
  "csaw" : false
}