Devuan bug report logs - #863
haproxy forward upgrade and connection headers as default (h2c request smuggling)

Package: haproxy; Reported by: gr0 bUst4 <[email protected]>; Keywords: debian; dated Mon, 28 Oct 2024 10:38:01 UTC; Maintainer for haproxy is (unknown).

Added tag(s) debian. Request was from Mark Hindley <[email protected]> to [email protected]. Full text available.

Message received at [email protected]:

Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=193.36.131.86; helo=mx.hindley.org.uk; [email protected]; receiver=<UNKNOWN> 
Date: Mon, 28 Oct 2024 19:27:55 +0000
From: Mark Hindley <[email protected]>
To: gr0 bUst4 <[email protected]>, [email protected]
Subject: Re: [devuan-dev] bug#863: haproxy forward upgrade and connection
 headers as default (h2c request smuggling)
Message-ID: <[email protected]>
References: <[email protected]>
 <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <[email protected]>

Control: tags -1 debian

On Mon, Oct 28, 2024 at 10:32:09AM +0000, gr0 bUst4 wrote:
>    Package: haproxy
> 
>    Version: 2.6.12-1
> suggest to fix this default forwarding

Devuan uses Debian's haproxy packages directly without recompilation. So when
this is fixed in Debian it will be inherited by Devuan.

>    If so, it's already backported for next stable releases:
>    3.0: cba44958ae
>    2.9: cf31943d74

haproxy    | 2.9.11-1                | testing                  | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 2.9.11-1                | unstable                 | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 2.9.11-1                | unstable-debug           | source
haproxy    | 3.0.5-1                 | experimental             | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 3.0.5-1                 | experimental-debug       | source

Mark

Information forwarded to [email protected], [email protected]:
bug#863; Package haproxy. Full text available.

Message received at [email protected]:

Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=198.252.153.6; helo=mx0.riseup.net; [email protected]; receiver=<UNKNOWN> 
Content-Type: multipart/alternative;
 boundary="------------iINTW0xkWoq4uDLUV0R3owpG"
Message-ID: <[email protected]>
Date: Mon, 28 Oct 2024 10:32:09 +0000
MIME-Version: 1.0
Subject: haproxy forward upgrade and connection headers as default (h2c
 request smuggling)
References: <[email protected]>
Content-Language: en-US
From: gr0 bUst4 <[email protected]>
To: [email protected]
In-Reply-To: <[email protected]>

This is a multi-part message in MIME format.
--------------iINTW0xkWoq4uDLUV0R3owpG
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Package: haproxy

Version: 2.6.12-1

suggest to fix this default forwarding


-------- Message transféré --------
Sujet : 	Re: CVE request: headers forward can lead to h2c request 
smuggling (fwd)
Date : 	Mon, 28 Oct 2024 07:08:40 +0100
De : 	Willy TARREAU <[email protected]>
Pour : 	[email protected]



Hello,

Thanks for contacting us!

> i did a CVE request about HAProxy and the default forward of the headers
> upgrade and connection which can lead to an h2c request smuggling or a
> web-socket smuggling.
>
> The CVE request is just about h2c (over clear text) i didn't POC 
> enough for
> the web-socket smuggling.
>
> I'll appreciate to talk about this with you.

I guess you're speaking about this commit:

7b89aa5b19 ("BUG/MINOR: h1: do not forward h2c upgrade header token")

If so, it's already backported for next stable releases:
3.0: cba44958ae
2.9: cf31943d74

If not, do not hesitate to share details about your concerns.

Thanks,
Willy
--------------iINTW0xkWoq4uDLUV0R3owpG
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Package: haproxy</p>
    <p>Version: 2.6.12-1<br>
      <br>
    </p>
    <pre>suggest to fix this default forwarding</pre>
    <div class="moz-forward-container"><br>
      -------- Message transféré --------
      <table class="moz-email-headers-table" cellspacing="0"
        cellpadding="0" border="0">
        <tbody>
          <tr>
            <th valign="BASELINE" nowrap="nowrap" align="RIGHT">Sujet :
            </th>
            <td>Re: CVE request: headers forward can lead to h2c request
              smuggling (fwd)</td>
          </tr>
          <tr>
            <th valign="BASELINE" nowrap="nowrap" align="RIGHT">Date : </th>
            <td>Mon, 28 Oct 2024 07:08:40 +0100</td>
          </tr>
          <tr>
            <th valign="BASELINE" nowrap="nowrap" align="RIGHT">De : </th>
            <td>Willy TARREAU <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]">&lt;[email protected]&gt;</a></td>
          </tr>
          <tr>
            <th valign="BASELINE" nowrap="nowrap" align="RIGHT">Pour : </th>
            <td><a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a></td>
          </tr>
        </tbody>
      </table>
      <br>
      <br>
      Hello,<br>
      <br>
      Thanks for contacting us!<br>
      <br>
      <blockquote type="cite">i did a CVE request about HAProxy and the
        default forward of the headers<br>
        upgrade and connection which can lead to an h2c request
        smuggling or a<br>
        web-socket smuggling.<br>
        <br>
        The CVE request is just about h2c (over clear text) i didn't POC
        enough for<br>
        the web-socket smuggling.<br>
        <br>
        I'll appreciate to talk about this with you.<br>
      </blockquote>
      <br>
      I guess you're speaking about this commit:<br>
      <br>
      7b89aa5b19 ("BUG/MINOR: h1: do not forward h2c upgrade header
      token")<br>
      <br>
      If so, it's already backported for next stable releases:<br>
      3.0: cba44958ae<br>
      2.9: cf31943d74<br>
      <br>
      If not, do not hesitate to share details about your concerns.<br>
      <br>
      Thanks,<br>
      Willy<br>
    </div>
  </body>
</html>

--------------iINTW0xkWoq4uDLUV0R3owpG--

Acknowledgement sent to gr0 bUst4 <[email protected]>:
New bug report received and forwarded. Copy sent to [email protected]. Full text available.

Report forwarded to [email protected], [email protected]:
bug#863; Package haproxy. Full text available.

Devuan bug report logs - #863 haproxy forward upgrade and connection headers as default (h2c request smuggling)

Message received at [email protected]:

Message received at [email protected]:

Devuan bug report logs - #863
haproxy forward upgrade and connection headers as default (h2c request smuggling)