CVE-2018-11469 | BDVDB-2026-101170 Detail

Description#

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/104347
https://usn.ubuntu.com/3663-1/
https://git.haproxy.org/?p=haproxy-1.8.git%3Ba=commit%3Bh=17514045e5d934dede62116216c1b016fe23dd06
https://access.redhat.com/errata/RHSA-2019:1436

Exploit#

No public exploit known

History#

Version 12018-05-25Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.