NetSight
IP …
medium5.0

CVE-2013-2175

HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote at…

Impact

HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.

Affected products

VendorProductAffected versions
DebianDebian Linux
Version 6.0
CanonicalUbuntu Linux
Versions 12.04, 12.10, 13.04
RedhatEnterprise Linux Load Balancer
Versions 6.0, 6.4
HaproxyHaproxy
Versions 1.4, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4

Weakness classification

CWE-20CWE-284

References