Data Plane Api Ce
Monthly
Unauthenticated remote attackers can gain full administrative control of the HAProxy Data Plane API - and through it the managed HAProxy load balancer - in Community and Enterprise Edition releases 2.2.0 through 3.4.3 when a specific mTLS topology is deployed. When a TLS Certificate Authority (tls_ca) and a numeric TLS port (tls_port) are configured, Server.ConfigureAPI() sets a process-global flag that disables HTTP Basic authentication on a request handler shared concurrently by HTTP, HTTPS, and UNIX-domain-socket listeners, while mutual-TLS client-certificate verification is only enforced on the HTTPS path; every other active listener therefore fails open. An attacker who can reach a plain HTTP or UNIX management endpoint can read cleartext HAProxy configuration data and replace the managed configuration via the raw configuration endpoint; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.4.4, 3.3.9, 3.2.17, 3.0.25 and 2.9.29 (plus EE backports).
Unauthenticated remote attackers can gain full administrative control of the HAProxy Data Plane API - and through it the managed HAProxy load balancer - in Community and Enterprise Edition releases 2.2.0 through 3.4.3 when a specific mTLS topology is deployed. When a TLS Certificate Authority (tls_ca) and a numeric TLS port (tls_port) are configured, Server.ConfigureAPI() sets a process-global flag that disables HTTP Basic authentication on a request handler shared concurrently by HTTP, HTTPS, and UNIX-domain-socket listeners, while mutual-TLS client-certificate verification is only enforced on the HTTPS path; every other active listener therefore fails open. An attacker who can reach a plain HTTP or UNIX management endpoint can read cleartext HAProxy configuration data and replace the managed configuration via the raw configuration endpoint; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.4.4, 3.3.9, 3.2.17, 3.0.25 and 2.9.29 (plus EE backports).