CVE-2023-0056

Aliases:DEBIAN-CVE-2023-0056CGA-9f9h-h7xw-xjc6CGA-9v7j-59fr-v37wCGA-34wj-3772-5fmqCGA-547c-rxhv-5rqqCGA-5hfr-ccvp-8mgqCGA-5xvq-22mp-j2pvCGA-g5g4-cwhj-vw7fCGA-hh75-5vhf-cf4jCGA-p929-x93h-c4prCGA-prh2-6ghc-535jCGA-rm92-7h78-6hhgCGA-xjff-7f6g-f892CGA-xpfp-j7r8-rqcv
Advisory lineage Upstream: 0 Downstream: 16
Modified
Published: 23 Mar 2023, 00:00
Last modified:25 Feb 2025, 19:35

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
1.83% LOW
2% probability +1.67%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

23 Mar 2023, 00:00
Published
Vulnerability first disclosed
25 Feb 2025, 19:35
Last Modified
Vulnerability information updated

Description

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.83%• Percentile: 78%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • chainguard•haproxy-2.4

    < 0

  • chainguard•haproxy-2.6

    < 0

  • chainguard•haproxy-2.8

    < 0

  • chainguard•haproxy-3.0

    < 0

  • chainguard•haproxy-3.1

    < 0

  • chainguard•haproxy-3.2

    < 3.2.4-r1

  • chainguard•haproxy-3.3

    < 3.3.2-r0

  • wolfi•haproxy-3.2

    < 3.2.4-r1

  • wolfi•haproxy-3.3

    < 3.3.2-r0

  • debian•haproxy

    < 2.2.9-2+deb11u4 | < 2.6.8-1 | < 2.6.8-1 | < 2.6.8-1

  • fedoraproject•extra_packages_for_enterprise_linux

    8.0

  • fedoraproject•fedora

    36 | 37

  • haproxy•haproxy

    na

  • redhat•ceph_storage

    5.0

  • redhat•openshift_container_platform

    4.12 | 4.10 | 4.11

  • redhat•openshift_container_platform_for_ibm_linuxone

    4.12 | 4.10 | 4.11

  • redhat•openshift_container_platform_for_power

    4.12 | 4.10 | 4.11

  • redhat•openshift_container_platform_ibm_z_systems

    4.12 | 4.10 | 4.11

  • redhat•software_collections

    na

References (2)