Security update for haproxy
|References:||#1094846 #1100787 #1108683|
|Affected Products:|| |
An update that solves two vulnerabilities and has one errata is now available.
This update for haproxy to version 1.8.14 fixes the following issues:
These security issues were fixed:
- CVE-2018-14645: A flaw was discovered in the HPACK decoder what caused an out-of-bounds read in hpack_valid_idx() that resulted in a remote crash and denial of service (bsc#1108683)
- CVE-2018-11469: Incorrect caching of responses to requests including an Authorization header allowed attackers to achieve information disclosure via an unauthenticated remote request (bsc#1094846).
These non-security issues were fixed:
- Require apparmor-abstractions to reduce dependencies (bsc#1100787)
- hpack: fix improper sign check on the header index value
- cli: make sure the "getsock" command is only called on connections
- tools: fix set_net_port() / set_host_port() on IPv4
- patterns: fix possible double free when reloading a pattern list
- server: Crash when setting FQDN via CLI.
- kqueue: Don't reset the changes number by accident.
- snapshot: take the proxy's lock while dumping errors
- http/threads: atomically increment the error snapshot ID
- dns: check and link servers' resolvers right after config parsing
- h2: fix risk of memory leak on malformated wrapped frames
- session: fix reporting of handshake processing time in the logs
- stream: use atomic increments for the request counter
- thread: implement HA_ATOMIC_XADD()
- ECC cert should work with TLS = 1.1.1
- dns/server: fix incomatibility between SRV resolution and server state file
- hlua: Don't call RESET_SAFE_LJMP if SET_SAFE_LJMP returns 0.
- thread: lua: Wrong SSL context initialization.
- hlua: Make sure we drain the output buffer when done.
- lua: reset lua transaction between http requests
- mux_pt: dereference the connection with care in mux_pt_wake()
- lua: Bad HTTP client request duration.
- unix: provide a ->drain() function
- Fix spelling error in configuration doc
- cli/threads: protect some server commands against concurrent operations
- cli/threads: protect all "proxy" commands against concurrent updates
- lua: socket timeouts are not applied
- ssl: Use consistent naming for TLS protocols
- dns: explain set server ... fqdn requires resolver
- map: fix map_regm with backref
- ssl: loading dh param from certifile causes unpredictable error.
- ssl: fix missing error loading a keytype cert from a bundle.
- ssl: empty connections reported as errors.
- cli: make "show fd" thread-safe
- hathreads: implement a more flexible rendez-vous point
- threads: fix the no-thread case after the change to the sync point
- threads: add more consistency between certain variables in no-thread case
- threads: fix the double CAS implementation for ARMv7
- threads: Introduce double-width CAS on x86_64 and arm.
- lua: possible CLOSE-WAIT state with '\n' headers
For additional changes please refer to the changelog.
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise High Availability 15:
zypper in -t patch SUSE-SLE-Product-HA-15-2018-2332=1
- SUSE Linux Enterprise High Availability 15 (aarch64 ppc64le s390x x86_64):