CVE-2023-0836: 
HAProxy vulnerability analysis and mitigation

CVE-2023-0836 is an information leak vulnerability discovered in HAProxy, affecting versions 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, and 2.7 before 2.7.1. The vulnerability was identified on February 14, 2023 (CVE Mitre).

The vulnerability stems from 5 bytes being left uninitialized in the connection buffer when encoding the FCGIBEGINREQUEST record. This technical issue can result in sensitive data being disclosed to configured FastCGI backends in an unexpected manner (Debian Security, Red Hat Portal).

The vulnerability allows remote attackers to potentially access sensitive information through information leakage. The issue has been rated as having a Moderate security impact by Red Hat Product Security (Red Hat Portal).

Multiple vendors have released patches to address this vulnerability. Debian has fixed the issue in version 2.2.9-2+deb11u5 for the stable distribution (bullseye). Red Hat has released version 2.4.22-1 for Enterprise Linux 9. Users are recommended to upgrade their HAProxy installations to the patched versions (Debian Security, Red Hat Portal).