OPNsense Forum

English Forums => Web Proxy Filtering and Caching => Topic started by: sorano on September 08, 2021, 06:55:51 pm

Title: HAProxy vulnerable to HTTP Request Smuggling
Post by: sorano on September 08, 2021, 06:55:51 pm

Just a heads up to my fellow HAProxy users.
HAProxy has a vulnerability that is quite nasty, see the following github link for mitigation until a fixed version is available:

https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95

Title: Re: HAProxy vulnerable to HTTP Request Smuggling
Post by: gazd25 on October 01, 2021, 02:36:19 pm

Hi,

Is there a guide somewhere on how to apply the workaround, or has this already been resolved in the  21.7.3_3 update which I'm already running?

Thanks

Gareth

Title: Re: HAProxy vulnerable to HTTP Request Smuggling
Post by: sorano on October 01, 2021, 08:32:23 pm

This was fixed in 21.7.3 but forgotten in the release notes.

Title: Re: HAProxy vulnerable to HTTP Request Smuggling
Post by: franco on October 05, 2021, 09:08:35 am

Since HAProxy is not part of our core plugin maintainers need to write release notes for their plugins and those are properly linked in the release notes if updates exist. As of now, no maintainer writes release notes for binary package updates. It is what it is.


Cheers,
Franco

Title: Re: HAProxy vulnerable to HTTP Request Smuggling
Post by: gazd25 on October 06, 2021, 06:01:36 pm

Hi Franco,

No worries on that, just wanted to check if there was anything else I needed to do.

Thanks very much for the help guys :)

Gareth

Title: Re: HAProxy vulnerable to HTTP Request Smuggling
Post by: franco on October 07, 2021, 08:32:42 am

Usually the FreeBSD security audit works, but it was broken for two weeks which made it a little harder to know what was actually fixed and what was not beyond the scope of our release notes:

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258802

Also our nightly builds offer audit capability over all binary packages we provide (not just core dependencies):

https://nightly.opnsense.org/22.1/amd64/logs/202110060005/11-audit-OpenSSL.log.err

Quote

>>> The following vulnerable packages exist:
consul-1.9.9 is vulnerable
redis-6.2.5_1 is vulnerable
*** Error code 1

Long story short it's best to ask for help here if the situation is unclear. I just wanted to comment on the "forgotten" part that this was actually not the case because out of immediate scope.  :)


Cheers,
Franco