Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-791 advisory.

    Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy.
    If this vulnerability is exploited,  a remote attacker may access a path that is restricted by ACL (Access     Control List) set on the product. As a result, the attacker may obtain sensitive information.
    (CVE-2024-53008)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:4390-1 advisory.

    - CVE-2024-53008: Fixed HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-     compliant back-end server (bsc#1233973)

     Other fixes:

    - Update to version 2.8.11

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7133-1 advisory.

    Yuki Mogi discovered that HAProxy incorrectly handled the interpretation of certain HTTP requests. A     remote attacker could possibly use this issue to perform a request smuggling attack and obtain sensitive     information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213668	Amazon Linux 2023 : haproxy (ALAS2023-2025-791)	Nessus	Amazon Linux Local Security Checks	medium
213309	SUSE SLES15 / openSUSE 15 Security Update : haproxy (SUSE-SU-2024:4390-1)	Nessus	SuSE Local Security Checks	medium
212018	Ubuntu 24.04 LTS : HAProxy vulnerability (USN-7133-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2024-53008

medium

Tenable Plugins

medium

medium

medium