ALAS-2013-215


Amazon Linux AMI Security Advisory: ALAS-2013-215
Advisory Release Date: 2014-09-15 23:19 Pacific
Severity: Medium
References: CVE-2013-2175 

Issue Overview:

HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.


Affected Packages:

haproxy


Issue Correction:
Run yum update haproxy to update your system.

New Packages:
i686:
    haproxy-1.4.22-5.3.amzn1.i686
    haproxy-debuginfo-1.4.22-5.3.amzn1.i686

src:
    haproxy-1.4.22-5.3.amzn1.src

x86_64:
    haproxy-debuginfo-1.4.22-5.3.amzn1.x86_64
    haproxy-1.4.22-5.3.amzn1.x86_64