Devuan logs - #863, boring messages

Message sent to [email protected], [email protected]:

Subject: bug#863: haproxy forward upgrade and connection headers as default (h2c request smuggling)
Reply-To: gr0 bUst4 <[email protected]>, [email protected]
Resent-From: gr0 bUst4 <[email protected]>
Resent-To: [email protected]
Resent-CC: [email protected]
Resent-Date: Mon, 28 Oct 2024 10:38:01 +0000
Resent-Message-ID: <[email protected]>
Resent-Sender: [email protected]
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=198.252.153.6; helo=mx0.riseup.net; [email protected]; receiver=<UNKNOWN> 
Content-Type: multipart/alternative;
 boundary="------------iINTW0xkWoq4uDLUV0R3owpG"
Message-ID: <[email protected]>
Date: Mon, 28 Oct 2024 10:32:09 +0000
MIME-Version: 1.0
Content-Language: en-US
From: gr0 bUst4 <[email protected]>
To: [email protected]
In-Reply-To: <[email protected]>

This is a multi-part message in MIME format.
--------------iINTW0xkWoq4uDLUV0R3owpG
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Package: haproxy

Version: 2.6.12-1

suggest to fix this default forwarding


-------- Message transféré --------
Sujet : 	Re: CVE request: headers forward can lead to h2c request 
smuggling (fwd)
Date : 	Mon, 28 Oct 2024 07:08:40 +0100
De : 	Willy TARREAU <[email protected]>
Pour : 	[email protected]



Hello,

Thanks for contacting us!

> i did a CVE request about HAProxy and the default forward of the headers
> upgrade and connection which can lead to an h2c request smuggling or a
> web-socket smuggling.
>
> The CVE request is just about h2c (over clear text) i didn't POC 
> enough for
> the web-socket smuggling.
>
> I'll appreciate to talk about this with you.

I guess you're speaking about this commit:

7b89aa5b19 ("BUG/MINOR: h1: do not forward h2c upgrade header token")

If so, it's already backported for next stable releases:
3.0: cba44958ae
2.9: cf31943d74

If not, do not hesitate to share details about your concerns.

Thanks,
Willy
--------------iINTW0xkWoq4uDLUV0R3owpG
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Package: haproxy</p>
    <p>Version: 2.6.12-1<br>
      <br>
    </p>
    <pre>suggest to fix this default forwarding</pre>
    <div class="moz-forward-container"><br>
      -------- Message transféré --------
      <table class="moz-email-headers-table" cellspacing="0"
        cellpadding="0" border="0">
        <tbody>
          <tr>
            <th valign="BASELINE" nowrap="nowrap" align="RIGHT">Sujet :
            </th>
            <td>Re: CVE request: headers forward can lead to h2c request
              smuggling (fwd)</td>
          </tr>
          <tr>
            <th valign="BASELINE" nowrap="nowrap" align="RIGHT">Date : </th>
            <td>Mon, 28 Oct 2024 07:08:40 +0100</td>
          </tr>
          <tr>
            <th valign="BASELINE" nowrap="nowrap" align="RIGHT">De : </th>
            <td>Willy TARREAU <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]">&lt;[email protected]&gt;</a></td>
          </tr>
          <tr>
            <th valign="BASELINE" nowrap="nowrap" align="RIGHT">Pour : </th>
            <td><a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a></td>
          </tr>
        </tbody>
      </table>
      <br>
      <br>
      Hello,<br>
      <br>
      Thanks for contacting us!<br>
      <br>
      <blockquote type="cite">i did a CVE request about HAProxy and the
        default forward of the headers<br>
        upgrade and connection which can lead to an h2c request
        smuggling or a<br>
        web-socket smuggling.<br>
        <br>
        The CVE request is just about h2c (over clear text) i didn't POC
        enough for<br>
        the web-socket smuggling.<br>
        <br>
        I'll appreciate to talk about this with you.<br>
      </blockquote>
      <br>
      I guess you're speaking about this commit:<br>
      <br>
      7b89aa5b19 ("BUG/MINOR: h1: do not forward h2c upgrade header
      token")<br>
      <br>
      If so, it's already backported for next stable releases:<br>
      3.0: cba44958ae<br>
      2.9: cf31943d74<br>
      <br>
      If not, do not hesitate to share details about your concerns.<br>
      <br>
      Thanks,<br>
      Willy<br>
    </div>
  </body>
</html>

--------------iINTW0xkWoq4uDLUV0R3owpG--

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.509 (Entity 5.509)
Content-Type: text/plain; charset=utf-8
X-Loop: [email protected]
From: "Devuan bug Tracking System" <[email protected]>
To: gr0 bUst4 <[email protected]>
Subject: bug#863: Acknowledgement (haproxy forward upgrade and connection
 headers as default (h2c request smuggling))
Message-ID: <[email protected]>
References: <[email protected]>
X-Devuan-PR-Message: ack 863
X-Devuan-PR-Package: haproxy
Reply-To: [email protected]
Date: Mon, 28 Oct 2024 10:38:03 +0000

Thank you for filing a new bug report with Devuan.

You can follow progress on this bug here: 863: https://bugs.devuan.org/cgi/=
bugreport.cgi?bug=3D863.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 [email protected]

If you wish to submit further information on this problem, please
send it to [email protected].

Please do not send mail to [email protected] unless you wish
to report a problem with the Bug-tracking system.

--=20
863: https://bugs.devuan.org/cgi/bugreport.cgi?bug=3D863
Devuan Bug Tracking System
Contact [email protected] with problems

Message sent to [email protected], [email protected]:

Subject: bug#863: [devuan-dev] bug#863: haproxy forward upgrade and connection headers as default (h2c request smuggling)
Reply-To: Mark Hindley <[email protected]>, [email protected]
Resent-From: Mark Hindley <[email protected]>
Resent-To: [email protected]
Resent-CC: [email protected]
Resent-Date: Mon, 28 Oct 2024 19:50:27 +0000
Resent-Message-ID: <[email protected]>
Resent-Sender: [email protected]
References: <[email protected]> <[email protected]> <[email protected]>
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=193.36.131.86; helo=mx.hindley.org.uk; [email protected]; receiver=<UNKNOWN> 
Date: Mon, 28 Oct 2024 19:27:55 +0000
From: Mark Hindley <[email protected]>
To: gr0 bUst4 <[email protected]>, [email protected]
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <[email protected]>

Control: tags -1 debian

On Mon, Oct 28, 2024 at 10:32:09AM +0000, gr0 bUst4 wrote:
>    Package: haproxy
> 
>    Version: 2.6.12-1
> suggest to fix this default forwarding

Devuan uses Debian's haproxy packages directly without recompilation. So when
this is fixed in Debian it will be inherited by Devuan.

>    If so, it's already backported for next stable releases:
>    3.0: cba44958ae
>    2.9: cf31943d74

haproxy    | 2.9.11-1                | testing                  | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 2.9.11-1                | unstable                 | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 2.9.11-1                | unstable-debug           | source
haproxy    | 3.0.5-1                 | experimental             | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 3.0.5-1                 | experimental-debug       | source

Mark

Message received at [email protected]:

Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=193.36.131.86; helo=mx.hindley.org.uk; [email protected]; receiver=<UNKNOWN> 
Date: Mon, 28 Oct 2024 19:27:55 +0000
From: Mark Hindley <[email protected]>
To: gr0 bUst4 <[email protected]>, [email protected]
Subject: Re: [devuan-dev] bug#863: haproxy forward upgrade and connection
 headers as default (h2c request smuggling)
Message-ID: <[email protected]>
References: <[email protected]>
 <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <[email protected]>

Control: tags -1 debian

On Mon, Oct 28, 2024 at 10:32:09AM +0000, gr0 bUst4 wrote:
>    Package: haproxy
> 
>    Version: 2.6.12-1
> suggest to fix this default forwarding

Devuan uses Debian's haproxy packages directly without recompilation. So when
this is fixed in Debian it will be inherited by Devuan.

>    If so, it's already backported for next stable releases:
>    3.0: cba44958ae
>    2.9: cf31943d74

haproxy    | 2.9.11-1                | testing                  | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 2.9.11-1                | unstable                 | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 2.9.11-1                | unstable-debug           | source
haproxy    | 3.0.5-1                 | experimental             | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 3.0.5-1                 | experimental-debug       | source

Mark