BUG/MAJOR: fcgi: Fix uninitialized reserved bytes
authorYoufu Zhang <zhangyoufu@gmail.com>
Fri, 9 Dec 2022 11:15:48 +0000 (19:15 +0800)
committerSalvatore Bonaccorso <carnil@debian.org>
Mon, 10 Apr 2023 14:18:09 +0000 (15:18 +0100)
commita47a88ac0f46e3e0f03412cf389b85ef0ee09e5c
tree33f10bf4401ef5d99fb28c8b634672d38d7e1612
parent3f7575dc035b9cacaf990020ddfe3a2685d214e0
BUG/MAJOR: fcgi: Fix uninitialized reserved bytes

Origin: https://git.haproxy.org/?p=haproxy-2.2.git;a=commit;h=18575ba4e5057afdb80cc06135272889ae1fa2d1
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-0836

The output buffer is not zero-initialized. If we don't clear reserved
bytes, fcgi requests sent to backend will leak sensitive data.

This patch must be backported as far as 2.2.

(cherry picked from commit 2e6bf0a2722866ae0128a4392fa2375bd1f03ff8)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit db03179fee55c60a92ce6b86a0f04dbb9ba0328b)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit f988992d16f45ef03d5bbb024a1042ed8123e4c5)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 0dc4cdc276d4a0e3347b7c3c4aedca2a2e0ab428)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 0c86fce8028d409de4181e82eec967cfb1e6268e)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
Gbp-Pq: Name 2.2-BUG-MAJOR-fcgi-Fix-uninitialized-reserved-bytes.patch
src/fcgi.c