Amazon Linux 1 Security Advisory: ALAS-2013-215
Advisory Release Date: 2013-08-07 21:21 Pacific
Advisory Updated Date: 2014-09-15 23:19 Pacific
Severity:
Medium
Issue Overview:
HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.
Affected Packages:
haproxy
Issue Correction:
Run yum update haproxy to update your system.
New Packages:
i686:
haproxy-1.4.22-5.3.amzn1.i686
haproxy-debuginfo-1.4.22-5.3.amzn1.i686
src:
haproxy-1.4.22-5.3.amzn1.src
x86_64:
haproxy-debuginfo-1.4.22-5.3.amzn1.x86_64
haproxy-1.4.22-5.3.amzn1.x86_64