CVE-2022-0711

Description

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 66.48%• Percentile: 99%

Techniques & Countermeasures

• CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

  The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Systems

• debian•debian_linux

  11.0

• haproxy•haproxy

  ≥ 2.2.0, < 2.2.21 | ≥ 2.3.0, < 2.3.18 | ≥ 2.4.0, < 2.4.13

• redhat•enterprise_linux

  7.0 | 8.0

• redhat•openshift_container_platform

  4.0

• redhat•software_collections

  na

References (4)

• https://access.redhat.com/security/cve/cve-2022-0711
• https://www.mail-archive.com/haproxy%40formilux.org/msg41833.html
• https://github.com/haproxy/haproxy/commit/bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8
• https://www.debian.org/security/2022/dsa-5102