Amazon Linux 2 Security Advisory: ALASHAPROXY2-2023-004
Advisory Release Date: 2023-08-21 21:00 Pacific
Advisory Updated Date: 2023-09-25 22:11 Pacific
Severity:
Medium
Issue Overview:
The HAProxy Github issue describes this vulnerability as follows:
Crash (SEGV) in http_wait_for_response in 2.2.19, 2.2.24, and 2.2.26 because sl (start line) variable is NULL. (CVE-2023-0056)
Affected Packages:
haproxy2
Note:
This advisory is applicable to Amazon Linux 2 - Haproxy2 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update haproxy2 to update your system.
New Packages:
aarch64:
haproxy2-2.2.17-1.amzn2.0.4.aarch64
haproxy2-debuginfo-2.2.17-1.amzn2.0.4.aarch64
i686:
haproxy2-2.2.17-1.amzn2.0.4.i686
haproxy2-debuginfo-2.2.17-1.amzn2.0.4.i686
src:
haproxy2-2.2.17-1.amzn2.0.4.src
x86_64:
haproxy2-2.2.17-1.amzn2.0.4.x86_64
haproxy2-debuginfo-2.2.17-1.amzn2.0.4.x86_64