Amaury Denoyelle
789d4abd73
BUG/MEDIUM: h3: ensure the ":method" pseudo header is totally valid
...
Ensure pseudo-header method is only constitued of valid characters
according to RFC 9110. If an invalid value is found, the request is
rejected and stream is resetted.
Previously only characters forbidden in headers were rejected (NUL/CR/LF),
but this is insufficient for :method, where some other forbidden chars
might be used to trick a non-compliant backend server into seeing a
different path from the one seen by haproxy. Note that header injection
is not possible though.
This must be backported up to 2.6.
Many thanks to Yuki Mogi of FFRI Security Inc for the detailed report
that allowed to quicky spot, confirm and fix the problem.
2024-06-28 14:36:30 +02:00
..
2023-08-01 10:49:06 +02:00
2023-05-11 15:37:04 +02:00
2024-04-04 19:10:01 +02:00
2023-10-06 17:06:44 +02:00
2024-06-27 18:01:27 +02:00
2022-09-08 16:21:22 +02:00
2024-05-10 17:18:13 +02:00
2024-05-10 17:18:13 +02:00
2023-01-27 15:18:59 +01:00
2021-07-16 19:18:41 +02:00
2024-04-11 16:41:08 +02:00
2024-03-29 17:08:37 +01:00
2024-05-02 10:55:25 +02:00
2024-03-28 17:28:20 +01:00
2024-06-26 10:17:09 +02:00
2024-03-05 11:50:34 +01:00
2022-03-04 08:58:32 +01:00
2023-02-21 11:44:55 +01:00
2021-07-20 18:03:08 +02:00
2021-09-15 11:07:18 +02:00
2024-06-17 19:37:29 +02:00
2023-10-17 18:51:13 +02:00
2024-05-10 17:18:13 +02:00
2023-09-01 14:00:04 +02:00
2023-04-21 14:36:45 +02:00
2022-08-17 10:45:22 +02:00
2024-04-17 11:14:44 +02:00
2022-11-30 14:02:36 +01:00
2023-05-17 09:33:54 +02:00
2024-05-17 15:57:18 +02:00
2024-02-02 17:12:06 +01:00
2023-04-07 00:49:17 +02:00
2023-04-07 00:46:59 +02:00
2024-05-24 14:47:21 +02:00
2024-05-24 14:47:21 +02:00
2024-05-02 10:55:25 +02:00
2023-07-20 11:01:09 +02:00
2023-09-08 16:25:19 +02:00
2023-11-23 15:39:21 +01:00
2024-06-27 18:01:27 +02:00
2024-03-05 11:50:34 +01:00
2022-03-04 08:58:32 +01:00
2022-03-04 08:58:32 +01:00
2024-03-25 17:34:19 +00:00
2024-03-25 17:34:19 +00:00
2024-03-25 17:34:19 +00:00
2024-05-10 17:18:13 +02:00
2024-05-15 19:37:12 +02:00
2023-05-11 12:02:21 +02:00
2023-11-29 08:59:27 +01:00
2023-11-29 08:59:27 +01:00
2024-04-04 19:10:01 +02:00
2023-04-13 16:57:51 +02:00
2023-04-13 16:57:51 +02:00
2024-03-05 11:50:34 +01:00
2024-05-02 10:55:25 +02:00
2023-10-26 15:18:48 +02:00
2024-06-26 07:38:21 +02:00
2024-03-15 11:31:48 +01:00
2024-04-05 15:40:42 +02:00
2024-04-26 11:29:25 +02:00
2021-09-23 16:13:17 +02:00
2024-01-31 15:22:12 +01:00
2023-08-08 19:10:54 +02:00
2022-05-30 09:59:26 +02:00
2022-05-30 09:59:26 +02:00
2024-05-16 10:31:17 +02:00
2023-05-05 16:28:32 +02:00
2024-06-14 18:25:58 +02:00
2024-03-13 09:24:46 +01:00
2021-11-18 10:50:58 +01:00
2024-04-10 15:50:00 +02:00
2023-01-13 11:22:13 +01:00
2024-04-29 17:10:47 +02:00
2024-03-05 11:50:34 +01:00
2023-01-27 15:18:59 +01:00
2023-01-27 15:18:59 +01:00
2024-04-04 19:10:01 +02:00
2023-01-27 15:18:59 +01:00
2023-05-11 15:37:04 +02:00
2021-10-14 16:38:07 +02:00
2024-06-28 14:36:30 +02:00
2024-05-15 19:03:17 +02:00
2023-11-17 12:13:00 +01:00
2022-04-22 15:45:47 +02:00
2022-04-22 15:45:47 +02:00
2022-04-14 16:57:12 +02:00
2024-04-24 15:54:55 +02:00
2024-03-05 11:50:34 +01:00
2021-10-14 16:38:14 +02:00
2021-10-07 01:41:14 +02:00
2021-10-07 01:41:14 +02:00
2021-10-07 01:41:14 +02:00
2021-10-07 01:41:14 +02:00
2024-03-29 17:08:37 +01:00
2024-03-29 17:08:37 +01:00
2024-06-26 07:38:21 +02:00
2024-04-27 09:36:36 +02:00
2024-05-17 17:35:51 +02:00
2024-04-05 15:40:42 +02:00
2024-06-13 15:43:09 +02:00
2024-06-13 15:43:09 +02:00
2024-06-17 19:37:29 +02:00
2024-06-17 19:37:29 +02:00
2024-03-05 11:50:34 +01:00
2022-11-30 14:02:36 +01:00
2024-05-17 16:33:53 +02:00
2023-10-25 11:44:54 +02:00
2024-05-16 10:58:20 +02:00
2024-05-16 10:58:20 +02:00
2021-11-10 15:53:01 +01:00
2024-06-27 16:08:42 +02:00
2021-10-07 01:41:14 +02:00
2022-08-06 17:12:51 +02:00
2022-11-29 15:14:39 +01:00
2024-04-16 07:37:28 +02:00
2022-05-27 19:33:35 +02:00
2022-05-27 19:33:35 +02:00
2024-06-17 17:40:49 +02:00
2023-12-06 10:24:41 +01:00
2023-09-21 09:50:55 +02:00
2024-05-03 09:01:36 +02:00
2023-12-21 14:22:27 +01:00
2022-12-08 17:32:57 +01:00
2023-08-12 19:04:34 +02:00
2024-04-12 18:01:55 +02:00
2024-03-05 11:50:34 +01:00
2023-11-23 17:38:58 +01:00
2024-05-22 10:01:57 +02:00
2024-03-05 11:50:34 +01:00
2023-04-23 09:46:15 +02:00
2024-03-05 11:50:34 +01:00
2024-04-16 07:37:28 +02:00
2024-05-24 14:36:31 +02:00
2023-04-23 09:46:15 +02:00
2024-06-17 19:37:29 +02:00
2024-05-02 10:55:25 +02:00
2023-12-21 15:42:08 +01:00
2023-05-11 14:04:51 +02:00
2024-05-16 10:31:17 +02:00
2021-09-23 15:27:25 +02:00
2024-05-16 10:31:17 +02:00
2024-03-05 11:50:34 +01:00
2022-03-04 08:58:32 +01:00
2024-03-05 11:50:34 +01:00
2022-10-30 17:17:56 +01:00
2024-03-05 11:50:34 +01:00
2024-03-05 11:50:34 +01:00
2024-04-02 18:47:19 +02:00
2024-04-02 18:47:19 +02:00
2023-11-28 15:37:50 +01:00
2023-11-28 15:47:18 +01:00
2023-11-30 15:04:27 +01:00
2023-07-27 10:51:03 +02:00
2024-05-24 14:36:31 +02:00
2024-05-10 17:18:13 +02:00
2023-01-19 15:09:01 +01:00
2024-01-31 16:28:54 +01:00
2024-01-31 16:28:54 +01:00
2023-11-09 10:32:31 +01:00
2023-11-28 15:37:22 +01:00
2024-02-14 11:32:29 +01:00
2024-02-14 11:32:29 +01:00
2023-11-23 16:23:14 +01:00
2023-12-21 16:33:06 +01:00
2023-11-28 15:47:18 +01:00
2023-11-28 15:47:18 +01:00
2024-03-05 11:50:34 +01:00
2024-03-11 14:27:51 +01:00
2024-01-26 17:29:27 +01:00
2024-02-20 16:42:05 +01:00
2023-07-27 10:51:03 +02:00
2024-03-11 14:27:51 +01:00
2023-11-09 16:23:52 +01:00
2022-05-30 09:59:26 +02:00
2022-04-21 12:03:20 +02:00
2024-01-26 16:02:05 +01:00
2024-04-10 11:06:41 +02:00
2024-05-22 16:22:22 +02:00
2024-01-12 16:08:36 +01:00
2023-11-30 15:59:45 +01:00
2023-11-28 15:37:22 +01:00
2023-10-11 14:15:31 +02:00
2024-06-12 18:05:40 +02:00
2024-04-10 11:17:21 +02:00
2024-01-02 11:44:42 +01:00
2021-08-28 12:49:58 +02:00
2024-01-02 10:29:41 +01:00
2023-12-21 14:22:27 +01:00
2024-03-25 17:34:19 +00:00
2024-05-21 11:42:35 +02:00
2023-07-03 16:32:01 +02:00
2024-02-20 15:18:39 +01:00
2024-05-10 17:18:13 +02:00
2024-05-24 14:36:31 +02:00
2024-05-24 14:36:31 +02:00
2024-05-22 10:01:57 +02:00
2024-06-26 15:05:06 +02:00
2023-11-23 16:23:14 +01:00
2024-04-24 10:25:38 +02:00
2022-11-24 08:32:27 +01:00
2021-09-15 11:07:18 +02:00
2024-03-09 11:23:52 +01:00
2024-03-09 11:23:52 +01:00
2023-05-07 07:07:44 +02:00
2022-01-28 19:04:02 +01:00
2024-05-21 20:14:05 +02:00
2023-11-23 16:23:14 +01:00
2023-04-01 18:33:40 +02:00
2024-05-17 17:35:51 +02:00
2024-05-21 18:30:45 +02:00
2021-10-07 01:41:14 +02:00
2024-05-17 17:35:51 +02:00
2024-03-05 11:50:34 +01:00
2024-03-20 16:12:10 +01:00
2024-05-17 17:35:51 +02:00
2024-06-13 16:48:17 +02:00
2024-06-13 19:36:40 +02:00
2023-05-15 10:48:05 +02:00
2024-04-26 11:34:02 +02:00
2024-05-03 09:01:36 +02:00
2024-04-18 17:04:08 +02:00
2024-04-19 01:54:00 +02:00
2024-04-18 17:04:08 +02:00
2024-05-02 16:43:26 +02:00
2024-05-03 09:01:36 +02:00
2024-05-02 16:42:36 +02:00
2024-06-05 07:28:10 +02:00
2024-06-05 07:28:10 +02:00
2024-05-17 11:00:45 +02:00
2024-06-26 15:05:06 +02:00
2024-06-13 15:43:09 +02:00
2024-06-26 15:05:06 +02:00
2024-04-03 15:53:18 +02:00
2024-02-07 15:02:13 +01:00
2023-11-27 11:24:52 +01:00
2024-04-04 19:10:01 +02:00
2024-01-02 11:44:42 +01:00
2024-03-05 11:50:34 +01:00
2024-03-05 11:50:34 +01:00
2021-10-07 01:41:14 +02:00
2023-05-04 18:09:50 +02:00
2023-08-01 10:48:28 +02:00
2024-05-10 17:18:13 +02:00
2023-04-13 16:57:51 +02:00
2024-04-29 14:47:37 +02:00
2024-05-24 14:36:31 +02:00
2023-04-05 08:46:06 +02:00
2023-11-27 17:15:14 +01:00
2022-01-03 14:40:58 +01:00
2024-03-08 17:20:43 +01:00
2024-04-17 11:14:44 +02:00
2024-05-29 15:00:02 +02:00
2024-03-05 11:50:34 +01:00
2021-09-11 20:37:50 +02:00