From febb1dd4c09f666aea64274da3e75fd04a4464ae Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Aug 01 2019 18:36:58 +0000 Subject: import haproxy-1.8.15-5.el8 --- diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ec3a304 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/haproxy-1.8.15.tar.gz diff --git a/.haproxy.metadata b/.haproxy.metadata new file mode 100644 index 0000000..8bda435 --- /dev/null +++ b/.haproxy.metadata @@ -0,0 +1 @@ +ed7dfe5c7fc39fbb3b54e981eb709fd8bcd87042 SOURCES/haproxy-1.8.15.tar.gz diff --git a/SOURCES/bz1664533-fix-handling-priority-flag-HTTP2-decoder.patch b/SOURCES/bz1664533-fix-handling-priority-flag-HTTP2-decoder.patch new file mode 100644 index 0000000..a2f97d3 --- /dev/null +++ b/SOURCES/bz1664533-fix-handling-priority-flag-HTTP2-decoder.patch @@ -0,0 +1,40 @@ +From 57c9ecf43f1ae0211367d8ba79540e3a5d288d34 Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Mon, 31 Dec 2018 07:41:24 +0100 +Subject: BUG/CRITICAL: mux-h2: re-check the frame length when PRIORITY is used +MIME-Version: 1.0 +Content-Type: text/plain; charset=latin1 +Content-Transfer-Encoding: 8bit + +Tim D�sterhus reported a possible crash in the H2 HEADERS frame decoder +when the PRIORITY flag is present. A check is missing to ensure the 5 +extra bytes needed with this flag are actually part of the frame. As per +RFC7540#4.2, let's return a connection error with code FRAME_SIZE_ERROR. + +Many thanks to Tim for responsibly reporting this issue with a working +config and reproducer. This issue was assigned CVE-2018-20615. + +This fix must be backported to 1.9 and 1.8. +--- + src/mux_h2.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/mux_h2.c b/src/mux_h2.c +index 5803a84ff..a67bbb049 100644 +--- a/src/mux_h2.c ++++ b/src/mux_h2.c +@@ -3297,6 +3297,11 @@ next_frame: + goto fail; + } + ++ if (flen < 5) { ++ h2c_error(h2c, H2_ERR_FRAME_SIZE_ERROR); ++ goto fail; ++ } ++ + hdrs += 5; // stream dep = 4, weight = 1 + flen -= 5; + } +-- +2.20.1 + diff --git a/SOURCES/halog.1 b/SOURCES/halog.1 new file mode 100644 index 0000000..39a9711 --- /dev/null +++ b/SOURCES/halog.1 @@ -0,0 +1,108 @@ +.TH HALOG "1" "July 2013" "halog" "User Commands" +.SH NAME +halog \- HAProxy log statistics reporter +.SH SYNOPSIS +.B halog +[\fI-h|--help\fR] +.br +.B halog +[\fIoptions\fR] +Only match response times larger|smaller than