An updated haproxy package that fixes one security issue is now available for Red Hat Enterprise Linux 6 and 7. HAProxy provides high availability, load balancing, and proxying for TCP and HTTP-based applications.

An implementation error related to the memory management of request and responses was found within HAProxy's buffer_slow_realign() function. An unauthenticated, remote attacker could possibly use this flaw to leak certain memory buffer contents from a past request or session. (CVE-2015-3281)

Note that, according to CVE-2015-3281, this issue only exists in HAProxy version 1.5.x prior to 1.5.14. All HAProxy users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

haproxy was updated to fix two security issues.

These security issues were fixed :

  - CVE-2015-3281: The buffer_slow_realign function in     HAProxy did not properly realign a buffer that is used     for pending outgoing data, which allowed remote     attackers to obtain sensitive information (uninitialized     memory contents of previous requests) via a crafted     request (bsc#937042).

  - Changed DH parameters to prevent Logjam attack.

These non-security issues were fixed :

  - BUG/MAJOR: buffers: make the buffer_slow_realign()     function respect output data

  - BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id

  - MEDIUM: ssl: replace standards DH groups with custom     ones

  - BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value     being overwritten

  - MINOR: ssl: add a destructor to free allocated SSL     ressources

  - BUG/MINOR: ssl: Display correct filename in error     message

  - MINOR: ssl: load certificates in alphabetical order

  - BUG/MEDIUM: checks: fix conflicts between agent checks     and ssl healthchecks

  - BUG/MEDIUM: ssl: force a full GC in case of memory     shortage

  - BUG/MEDIUM: ssl: fix bad ssl context init can cause     segfault in case of OOM.

  - BUG/MINOR: ssl: correctly initialize ssl ctx for invalid     certificates

  - MINOR: ssl: add statement to force some ssl options in     global.

  - MINOR: ssl: add fetchs 'ssl_c_der' and 'ssl_f_der' to     return DER formatted certs

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-467:01 advisory.

    HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high     availability environments. Indeed, it can:
    - route HTTP requests depending on statically assigned cookies
    - spread load among several servers while assuring server persistence     through the use of HTTP cookies
    - switch to backup servers in the event a main one fails
    - accept connections to special ports dedicated to service monitoring
    - stop accepting connections without breaking existing ones
    - add, modify, and delete HTTP headers in both directions
    - block requests matching particular patterns
    - persists clients to the correct application server depending on     application cookies
    - report detailed status as HTML pages to authenticated users from a URI     intercepted from the application     Security issues fixed with this release:
    CVE-2015-3281

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that HAProxy incorrectly handled certain buffers. A remote attacker could possibly use this issue to obtain sensitive information belonging to previous requests.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:2666 advisory.

    OpenShift Enterprise by Red Hat is the company's cloud computing     Platform-as-a-Service (PaaS) solution designed for on-premise or     private cloud deployments.

    The following security issue is addressed with this release:

    An implementation error related to the memory management of request     and responses was found within HAProxy's buffer_slow_realign()     function. An unauthenticated remote attacker could use this flaw     to leak certain memory buffer contents from a past request or     session. (CVE-2015-3281)

    Space precludes documenting all of the bug fixes in this advisory. See     the OpenShift Enterprise Technical Notes, which will be updated     shortly for release 2.2.8, for details about these changes:

    https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-     single/Technical_Notes/index.html

    All OpenShift Enterprise 2 users are advised to upgrade to these updated     packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2015-3281

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Red Hat Enterprise Linux CoreOS 2 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:2666 advisory.

  - haproxy: information leak in buffer_slow_realign() (CVE-2015-3281)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1393 advisory.

    This advisory aggregates security fixes for the haproxy SRPM in CIQ LTS 9.6. It addresses 17 CVEs:
    CVE-2023-45539, CVE-2025-32464, CVE-2023-40225, CVE-2023-0836, CVE-2023-0056, and 12 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
85977	RHEL 6 / 7 : haproxy 1.5 (RHSA-2015:1741)	Nessus	Red Hat Local Security Checks	2015/9/17	2019/10/24	medium
86623	openSUSE Security Update : haproxy (openSUSE-2015-682)	Nessus	SuSE Local Security Checks	2015/10/28	2021/1/19	medium
289700	MiracleLinux 4 : haproxy-1.5.4-2.AXS4.1 (AXSA:2015-467:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
84619	Ubuntu 14.10 / 15.04 : haproxy vulnerability (USN-2668-1)	Nessus	Ubuntu Local Security Checks	2015/7/8	2021/1/19	medium
119366	RHEL 6 : Red Hat OpenShift Enterprise 2.2.8 (RHSA-2015:2666)	Nessus	Red Hat Local Security Checks	2018/12/4	2024/6/3	high
85055	Fedora 21 : haproxy-1.5.14-1.fc21 (2015-11255)	Nessus	Fedora Local Security Checks	2015/7/29	2021/1/11	medium
311949	RHCOS 2 : Red Hat OpenShift Enterprise 2.2.8 (RHSA-2015:2666)	Nessus	Red Hat Local Security Checks	2026/5/4	2026/5/4	high
356264	Rocky Linux 9.6 [CIQ] Security Update: haproxy Multiple Vulnerabilities (ciqsa-2026_1393)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

检测

插件搜索

medium

medium

high

medium

high

medium

high

critical