openSUSE Security Update: Security update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3324-1 Rating: important References: #1094846 #1100787 #1108683 Cross-References: CVE-2018-11469 CVE-2018-14645 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for haproxy to version 1.8.14 fixes the following issues: These security issues were fixed: - CVE-2018-14645: A flaw was discovered in the HPACK decoder what caused an out-of-bounds read in hpack_valid_idx() that resulted in a remote crash and denial of service (bsc#1108683) - CVE-2018-11469: Incorrect caching of responses to requests including an Authorization header allowed attackers to achieve information disclosure via an unauthenticated remote request (bsc#1094846). These non-security issues were fixed: - Require apparmor-abstractions to reduce dependencies (bsc#1100787) - hpack: fix improper sign check on the header index value - cli: make sure the "getsock" command is only called on connections - tools: fix set_net_port() / set_host_port() on IPv4 - patterns: fix possible double free when reloading a pattern list - server: Crash when setting FQDN via CLI. - kqueue: Don't reset the changes number by accident. - snapshot: take the proxy's lock while dumping errors - http/threads: atomically increment the error snapshot ID - dns: check and link servers' resolvers right after config parsing - h2: fix risk of memory leak on malformated wrapped frames - session: fix reporting of handshake processing time in the logs - stream: use atomic increments for the request counter - thread: implement HA_ATOMIC_XADD() - ECC cert should work with TLS < v1.2 and openssl >= 1.1.1 - dns/server: fix incomatibility between SRV resolution and server state file - hlua: Don't call RESET_SAFE_LJMP if SET_SAFE_LJMP returns 0. - thread: lua: Wrong SSL context initialization. - hlua: Make sure we drain the output buffer when done. - lua: reset lua transaction between http requests - mux_pt: dereference the connection with care in mux_pt_wake() - lua: Bad HTTP client request duration. - unix: provide a ->drain() function - Fix spelling error in configuration doc - cli/threads: protect some server commands against concurrent operations - cli/threads: protect all "proxy" commands against concurrent updates - lua: socket timeouts are not applied - ssl: Use consistent naming for TLS protocols - dns: explain set server ... fqdn requires resolver - map: fix map_regm with backref - ssl: loading dh param from certifile causes unpredictable error. - ssl: fix missing error loading a keytype cert from a bundle. - ssl: empty connections reported as errors. - cli: make "show fd" thread-safe - hathreads: implement a more flexible rendez-vous point - threads: fix the no-thread case after the change to the sync point - threads: add more consistency between certain variables in no-thread case - threads: fix the double CAS implementation for ARMv7 - threads: Introduce double-width CAS on x86_64 and arm. - lua: possible CLOSE-WAIT state with '\n' headers For additional changes please refer to the changelog. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1229=1 Package List: - openSUSE Leap 15.0 (x86_64): haproxy-1.8.14~git0.52e4d43b-lp150.2.3.1 haproxy-debuginfo-1.8.14~git0.52e4d43b-lp150.2.3.1 haproxy-debugsource-1.8.14~git0.52e4d43b-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-11469.html https://www.suse.com/security/cve/CVE-2018-14645.html https://bugzilla.suse.com/1094846 https://bugzilla.suse.com/1100787 https://bugzilla.suse.com/1108683 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org