[USN-7431-1] HAProxy vulnerability

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmf37poFAwAAAAAACgkQZWnYVadEvpNH
MA//SkE6R/gANisV/e5wqx6rrWrPKwLpCHgN4G3etyplAbc+Avbz0fUROGBcXZ/6G1r4BiAjjXvx
S1bRb34BoXYlHSlzACaKiUqFn+8uevPmXetMeZVRgzyeCAyZEp8gC2G2EwqNAYM+8d0fu4MOyRYc
aLxqix7DP+bZrP+WbNPq7CdYKA8t8y6ryabrRzysRoq4htnjbUELBnWHrcPaN56Ubk0FsDEEfagS
dkf92fX0L0bdEfd9HyOZxLFwajBpaxWV5bTybGHJnClvbtlERJoTAMyoUpuL4JGyShaAyte5tnd7
0p1GFK3zE+h+ld2I83Vk93wM1waeIKDXlrB1g1sEK2UswUd3hOrljF+mqonpTS0igO0BKsrjBsZH
aQTii8vuy79zPa/InUKfltTv43uD7dAvcjIlfek6kR1VAnXXV9/cweglPRnGppVt4ErYU8Iha6Hj
8SRVgN8DLa6zjXqpz6Gpw5Fsbft3kcjzA7FTfpF/ozdsOKSSsbH898ffCelxXs0sEGrIc6w10k5e
v0OdLsC/vMTOs1PtM9z+SSVOnklH3vOnyMI9UDWNFnjJzZXdr9YmgQTiryyYyf7vYugOtGqWzHZo
A+WOYJgn1i2w2OoiktXOdzhPJy0+veq/vP6Kvj7CxSnzuKVUAD/T4HOy40j9uYn2xev4fake6MWM
haw=
=SCLF
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7431-1
April 10, 2025

haproxy vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

HAProxy could be made to crash or run programs if it received specially
crafted network traffic.

Software Description:
- haproxy: fast and reliable load balancing reverse proxy

Details:

Aleandro Prudenzano and Edoardo Geraci discovered that HAProxy incorrectly
handled certain uncommon configurations that replace multiple short
patterns with a longer one. A remote attacker could use this issue to cause
HAProxy to crash, resulting in a denial of service, or possibly execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
haproxy 2.9.10-1ubuntu1.2

Ubuntu 24.04 LTS
haproxy 2.8.5-1ubuntu3.3

Ubuntu 22.04 LTS
haproxy 2.4.24-0ubuntu0.22.04.2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7431-1
CVE-2025-32464

Package Information:
https://launchpad.net/ubuntu/+source/haproxy/2.9.10-1ubuntu1.2
https://launchpad.net/ubuntu/+source/haproxy/2.8.5-1ubuntu3.3
https://launchpad.net/ubuntu/+source/haproxy/2.4.24-0ubuntu0.22.04.2