Home | Devuan | Git | Forum | Packages | Popcon
Donate now!
Download

Devuan bug report logs - #863
haproxy forward upgrade and connection headers as default (h2c request smuggling)

Package: haproxy; Maintainer for haproxy is (unknown); Source for haproxy is src:haproxy.

Reported by: gr0 bUst4 <bUst4gr0@riseup.net>

Date: Mon, 28 Oct 2024 10:38:01 UTC

Severity: normal

Tags: debian

Full log

Message #5 received at submit@bugs.devuan.org (full text, mbox, reply):

Received: (at submit) by bugs.devuan.org; 28 Oct 2024 10:37:38 +0000
Return-Path: <bUst4gr0@riseup.net>
Delivered-To: bugs@devuan.org
Received: from email.devuan.org [2a01:4f9:fff1:13::5fd9:f9e4]
	by doc.devuan.org with IMAP (fetchmail-6.4.16)
	for <debbugs@localhost> (single-drop); Mon, 28 Oct 2024 10:37:38 +0000 (UTC)
Received: from email.devuan.org
	by email.devuan.org with LMTP
	id TJMbBVhpH2fcZgAAmSBk0A
	(envelope-from <bUst4gr0@riseup.net>)
	for <bugs@devuan.org>; Mon, 28 Oct 2024 10:37:12 +0000
Received: by email.devuan.org (Postfix, from userid 109)
	id E30C63FF; Mon, 28 Oct 2024 10:37:11 +0000 (UTC)
Authentication-Results: email.devuan.org;
	dkim=pass (1024-bit key; secure) header.d=riseup.net header.i=@riseup.net header.a=rsa-sha256 header.s=squak header.b=ERWJ+yiT;
	dkim-atps=neutral
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on email.devuan.org
X-Spam-Level: 
X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS,
	T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=198.252.153.6; helo=mx0.riseup.net; envelope-from=bust4gr0@riseup.net; receiver=<UNKNOWN> 
Received: from mx0.riseup.net (mx0.riseup.net [198.252.153.6])
	by email.devuan.org (Postfix) with ESMTPS id 54A6F4B
	for <submit@bugs.devuan.org>; Mon, 28 Oct 2024 10:37:07 +0000 (UTC)
Received: from fews02-sea.riseup.net (fews02-sea-pn.riseup.net [10.0.1.112])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
	(No client certificate requested)
	by mx0.riseup.net (Postfix) with ESMTPS id 4XcVFC4lNkz9vWB
	for <submit@bugs.devuan.org>; Mon, 28 Oct 2024 10:37:03 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak;
	t=1730111823; bh=uVK85ZhjhRly+eqne0bZfDZWjh90+rf+G2ND00xv5TQ=;
	h=Date:Subject:References:From:To:In-Reply-To:From;
	b=ERWJ+yiTqzai1uGu12vuu3bEX1jj/bVeaBvbdYAT9pmfNNC+PyCo7xC3Y7/RAp4LU
	 0Ri5/Z7NAJ7rUZYuShcEULuBIDpeowemRFC/my5I7vbIjPB84kKup0WYSkqe+6chud
	 V6mU8Vic0WlVCYQEwq/MrDkrsswHIQS1ippizrus=
X-Riseup-User-ID: 46C2C284AD90089F16D15E83560889ED43187EED0E3F790F7152CF5ACB2B6689
Received: from [127.0.0.1] (localhost [127.0.0.1])
	 by fews02-sea.riseup.net (Postfix) with ESMTPSA id 4XcVFC04lQzFtTK
	for <submit@bugs.devuan.org>; Mon, 28 Oct 2024 10:37:02 +0000 (UTC)
Content-Type: multipart/alternative;
 boundary="------------iINTW0xkWoq4uDLUV0R3owpG"
Message-ID: <33a6301a-2146-4b07-921e-724a2432c796@riseup.net>
Date: Mon, 28 Oct 2024 10:32:09 +0000
MIME-Version: 1.0
Subject: haproxy forward upgrade and connection headers as default (h2c
 request smuggling)
References: <20241028060840.GA6398@haproxy.com>
Content-Language: en-US
From: gr0 bUst4 <bUst4gr0@riseup.net>
To: submit@bugs.devuan.org
In-Reply-To: <20241028060840.GA6398@haproxy.com>
X-Forwarded-Message-Id: <20241028060840.GA6398@haproxy.com>

[Message part 1 (text/plain, inline)]
Package: haproxy

Version: 2.6.12-1

suggest to fix this default forwarding


-------- Message transféré --------
Sujet : 	Re: CVE request: headers forward can lead to h2c request 
smuggling (fwd)
Date : 	Mon, 28 Oct 2024 07:08:40 +0100
De : 	Willy TARREAU <wtarreau@haproxy.com>
Pour : 	bUst4gr0@riseup.net



Hello,

Thanks for contacting us!

> i did a CVE request about HAProxy and the default forward of the headers
> upgrade and connection which can lead to an h2c request smuggling or a
> web-socket smuggling.
>
> The CVE request is just about h2c (over clear text) i didn't POC 
> enough for
> the web-socket smuggling.
>
> I'll appreciate to talk about this with you.

I guess you're speaking about this commit:

7b89aa5b19 ("BUG/MINOR: h1: do not forward h2c upgrade header token")

If so, it's already backported for next stable releases:
3.0: cba44958ae
2.9: cf31943d74

If not, do not hesitate to share details about your concerns.

Thanks,
Willy
[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.

Devuan BTS -- Powered by Debian bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.

Devuan Bugs Owner <owner@bugs.devuan.org>.
Last modified: Thu Oct 31 05:27:04 2024;