Security update for haproxy

SUSE Security Update: Security update for haproxy
Announcement ID: SUSE-SU-2018:3249-1
Rating: important
References: #1094846 #1100787 #1108683
Cross-References: CVE-2018-11469 CVE-2018-14645
Affected Products:
  • SUSE Linux Enterprise High Availability 15

An update that solves two vulnerabilities and has one errata is now available.

Description:

This update for haproxy to version 1.8.14 fixes the following issues:
These security issues were fixed:

  • CVE-2018-14645: A flaw was discovered in the HPACK decoder what caused an out-of-bounds read in hpack_valid_idx() that resulted in a remote crash and denial of service (bsc#1108683)
  • CVE-2018-11469: Incorrect caching of responses to requests including an Authorization header allowed attackers to achieve information disclosure via an unauthenticated remote request (bsc#1094846).

These non-security issues were fixed:
  • Require apparmor-abstractions to reduce dependencies (bsc#1100787)
  • hpack: fix improper sign check on the header index value
  • cli: make sure the "getsock" command is only called on connections
  • tools: fix set_net_port() / set_host_port() on IPv4
  • patterns: fix possible double free when reloading a pattern list
  • server: Crash when setting FQDN via CLI.
  • kqueue: Don't reset the changes number by accident.
  • snapshot: take the proxy's lock while dumping errors
  • http/threads: atomically increment the error snapshot ID
  • dns: check and link servers' resolvers right after config parsing
  • h2: fix risk of memory leak on malformated wrapped frames
  • session: fix reporting of handshake processing time in the logs
  • stream: use atomic increments for the request counter
  • thread: implement HA_ATOMIC_XADD()
  • ECC cert should work with TLS = 1.1.1
  • dns/server: fix incomatibility between SRV resolution and server state file
  • hlua: Don't call RESET_SAFE_LJMP if SET_SAFE_LJMP returns 0.
  • thread: lua: Wrong SSL context initialization.
  • hlua: Make sure we drain the output buffer when done.
  • lua: reset lua transaction between http requests
  • mux_pt: dereference the connection with care in mux_pt_wake()
  • lua: Bad HTTP client request duration.
  • unix: provide a ->drain() function
  • Fix spelling error in configuration doc
  • cli/threads: protect some server commands against concurrent operations
  • cli/threads: protect all "proxy" commands against concurrent updates
  • lua: socket timeouts are not applied
  • ssl: Use consistent naming for TLS protocols
  • dns: explain set server ... fqdn requires resolver
  • map: fix map_regm with backref
  • ssl: loading dh param from certifile causes unpredictable error.
  • ssl: fix missing error loading a keytype cert from a bundle.
  • ssl: empty connections reported as errors.
  • cli: make "show fd" thread-safe
  • hathreads: implement a more flexible rendez-vous point
  • threads: fix the no-thread case after the change to the sync point
  • threads: add more consistency between certain variables in no-thread case
  • threads: fix the double CAS implementation for ARMv7
  • threads: Introduce double-width CAS on x86_64 and arm.
  • lua: possible CLOSE-WAIT state with '\n' headers

For additional changes please refer to the changelog.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise High Availability 15:
    zypper in -t patch SUSE-SLE-Product-HA-15-2018-2332=1

Package List:

  • SUSE Linux Enterprise High Availability 15 (aarch64 ppc64le s390x x86_64):
    • haproxy-1.8.14~git0.52e4d43b-3.3.2
    • haproxy-debuginfo-1.8.14~git0.52e4d43b-3.3.2
    • haproxy-debugsource-1.8.14~git0.52e4d43b-3.3.2

References: