CVE-2023-0836

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-0836
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0836.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-0836
Aliases
Downstream
Related
Published
2023-03-29T00:00:00Z
Modified
2026-07-15T01:49:13.650466552Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGIBEGINREQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

Database specific 
{
    "cna_assigner": "redhat",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0836.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "HAProxy 2.8, HAProxy 2.7.1, HAProxy 2.6.8, HAProxy 2.5.11, HAProxy 2.4.21, HAProxy 2.2.27"
                },
                {
                    "last_affected": "HAProxy 2.8, HAProxy 2.7.1, HAProxy 2.6.8, HAProxy 2.5.11, HAProxy 2.4.21, HAProxy 2.2.27"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "2.2"
                },
                {
                    "fixed": "2.2.27"
                },
                {
                    "introduced": "2.4"
                },
                {
                    "fixed": "2.4.21"
                },
                {
                    "introduced": "2.5"
                },
                {
                    "fixed": "2.5.11"
                },
                {
                    "introduced": "2.6"
                },
                {
                    "fixed": "2.6.8"
                },
                {
                    "introduced": "2.7"
                },
                {
                    "fixed": "2.7.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/haproxy/haproxy

Affected ranges

Type
GIT
Repo
https://github.com/haproxy/haproxy
Events
Introduced
f2e0833f16aa8c09e1c7001ff55aac4f13c643b7
Last affected
b4d0cd02c14d4db1cf54b0bd8ee328fb198553f3
Introduced
a1efc048bf8a5e14466dbe7317e73117e8d66176
Last affected
026fef98a014b9860f7058eae437ff0a11c78e20
Introduced
e54b43af1ec9dc656c04b09118583cb3c2ce56fa
Last affected
437fd289f2e32e56498d2d4da63852d483f284ef
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.5.0"
        },
        {
            "last_affected": "2.5.11"
        },
        {
            "introduced": "2.6.0"
        },
        {
            "last_affected": "2.6.8"
        },
        {
            "introduced": "2.1.0"
        },
        {
            "last_affected": "2.1.0"
        },
        {
            "introduced": "2.3.0"
        },
        {
            "last_affected": "2.3.0"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "last_affected": "2.7.0"
        }
    ],
    "cpe": [
        "cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:haproxy:haproxy:2.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haproxy:haproxy:2.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:haproxy:haproxy:2.7.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

2.*
2.1.0
2.3.0
2.7.0
v2.*
v2.1.0
v2.2-dev0
v2.2-dev1
v2.2-dev10
v2.2-dev11
v2.2-dev12
v2.2-dev2
v2.2-dev3
v2.2-dev4
v2.2-dev5
v2.2-dev6
v2.2-dev7
v2.2-dev8
v2.2-dev9
v2.2.0
v2.3-dev0
v2.3-dev1
v2.3-dev2
v2.3-dev3
v2.3-dev4
v2.3-dev5
v2.3-dev6
v2.3-dev7
v2.3-dev8
v2.3-dev9
v2.3.0
v2.4-dev0
v2.4-dev1
v2.4-dev10
v2.4-dev11
v2.4-dev12
v2.4-dev13
v2.4-dev14
v2.4-dev15
v2.4-dev16
v2.4-dev17
v2.4-dev18
v2.4-dev19
v2.4-dev2
v2.4-dev3
v2.4-dev4
v2.4-dev5
v2.4-dev6
v2.4-dev7
v2.4-dev8
v2.4-dev9
v2.4.0
v2.5-dev0
v2.5-dev1
v2.5-dev10
v2.5-dev11
v2.5-dev2
v2.5-dev3
v2.5-dev4
v2.5-dev5
v2.5-dev6
v2.5-dev7
v2.5-dev8
v2.5-dev9
v2.5.0
v2.6-dev0
v2.6-dev1
v2.6-dev2
v2.6-dev3
v2.6-dev4
v2.6-dev5
v2.6-dev6
v2.6-dev7
v2.6-dev8
v2.6.0
v2.7-dev0
v2.7-dev1
v2.7-dev10
v2.7-dev2
v2.7-dev3
v2.7-dev4
v2.7-dev5
v2.7-dev6
v2.7-dev7
v2.7-dev8
v2.7-dev9
v2.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0836.json"