Bug 34673 - Haproxy 2.8 subversion 15 to 16 update
Summary: Haproxy 2.8 subversion 15 to 16 update
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-10-16 11:57 CEST by Raphael Gertz
Modified: 2025-10-22 22:08 CEST (History)
4 users (show)

See Also:
Source RPM: haproxy-2.8.15-1.mga9.src.rpm
CVE: CVE-2025-11230
Status comment:


Attachments

Description Raphael Gertz 2025-10-16 11:57:18 CEST
Description of problem:
Haproxy is in version 2.8.15 in mageia version while 2.8.16 version is available with a critical, a major, few medium and few minor security updates for 2.8 branch.

Changelog there:
http://www.haproxy.org/download/2.8/src/CHANGELOG

Last version of 2.8 branch has a lot of minor and medium bugs fixed, we should update.

Fixed bug changelog:
2025/10/03 : 2.8.16
    - CRITICAL: mjson: fix possible DoS when parsing numbers
    - MAJOR: listeners: transfer connection accounting when switching listeners
    - MEDIUM: check: Requeue healthchecks on I/O events to handle check timeout
    - MEDIUM: check: Set SOCKERR by default when a connection error is reported
    - MEDIUM: checks: fix ALPN inheritance from server
    - MEDIUM: dns: Reset reconnect tempo when connection is finally established
    - MEDIUM: fd: Use the provided tgid in fd_insert() to get tgroup_info
    - MEDIUM: h1: Allow reception if we have early data
    - MEDIUM: h1/h2/h3: reject forbidden chars in the Host header field
    - MEDIUM: h2/h3: reject some forbidden chars in :authority before reassembly
    - MEDIUM: hlua: Forbid any L6/L7 sample fetche functions from lua services
    - MEDIUM: hlua: Report to SC when data were consumed on a lua socket
    - MEDIUM: hlua: Report to SC when output data are blocked on a lua socket
    - MEDIUM: http-client: Ask for more room when request data cannot be xferred
    - MEDIUM: http-client: Don't wake http-client applet if nothing was xferred
    - MEDIUM: http-client: Drain the request if an early response is received
    - MEDIUM: http-client: Notify applet has more data to deliver until the EOM
    - MEDIUM: http-client: Properly inc input data when HTX blocks are xferred
    - MEDIUM: http-client: Test HTX_FL_EOM flag before commiting the HTX buffer
    - MEDIUM: httpclient: Throw an error if an lua httpclient instance is reused
    - MEDIUM: mux-h2: Properly handle connection error during preface sending
    - MEDIUM: server: Duplicate healthcheck's alpn inherited from default server
    - MEDIUM: ssl: ca-file directory mode must read every certificates of a file
    - MEDIUM: ssl/clienthello: ECDSA with ssl-max-ver TLSv1.2 and no ECDSA ciphers
    - MEDIUM: ssl: create the mux immediately on early data
    - MEDIUM: ssl: Fix 0rtt to the server
    - MEDIUM: ssl: fix build with AWS-LC
    - MEDIUM: threads: Disable the workaround to load libgcc_s on macOS
    - MINOR: acl: set arg_list->kw to aclkw->kw string literal if aclkw is found
    - MINOR: activity: fix reporting of task latency
    - MINOR: applet: Don't trigger BUG_ON if the tid is not on appctx init
    - MINOR: cli: fix too many args detection for commands
    - MINOR: cli: Issue an error when too many args are passed for a command
    - MINOR: config/server: reject QUIC addresses
    - MINOR: dns: add tempo between 2 connection attempts for dns servers
    - MINOR: dns: prevent ds accumulation within dss
    - MINOR: h2: forbid 'Z' as well in header field names checks
    - MINOR: h3: don't insert more than one Host header
    - MINOR: h3: Fix errors introduced because of failed backport
    - MINOR: h3: forbid 'Z' as well in header field names checks
    - MINOR: h3: Set HTX flags corresponding to the scheme found in the request
    - MINOR: halog: exit with error when some output filters are set simultaneosly
    - MINOR: haproxy: be sure not to quit too early on soft stop
    - MINOR: hlua: Fix Channel:data() and Channel:line() to respect documentation
    - MINOR: hlua: Skip headers when a receive is performed on an HTTP applet
    - MINOR: hlua: take default-path into account with lua-load-per-thread
    - MINOR: http-client: Ignore 1XX interim responses in non-HTX mode
    - MINOR: http-client: Reject any 101-switching-protocols response
    - MINOR: init: Initialize random seed earlier in the init process
    - MINOR: init: relax LSTCHK_NETADM checks for non root
    - MINOR: jwt: Copy input and parameters in dedicated buffers in jwt_verify converter
    - MINOR: limits: compute_ideal_maxconn: don't cap remain if fd_hard_limit=0
    - MINOR: listener: really assign distinct IDs to shards
    - MINOR: log: Be able to use %ID alias at anytime of the stream's evaluation
    - MINOR: mux-h1: Don't pretend connection was released for TCP>H1>H2 upgrade
    - MINOR: mux-h1: Fix trace message in h1_detroy() to not relay on connection
    - MINOR: mux-h1: fix wrong lock label
    - MINOR: mux-h2: Reset streams with NO_ERROR code if full response was already sent
    - MINOR: mux-quic: do not decode if conn in error
    - MINOR: ocsp: Crash when updating CA during ocsp updates
    - MINOR: proxy: only use proxy_inc_fe_cum_sess_ver_ctr() with frontends
    - MINOR: quic: do not emit probe data if CONNECTION_CLOSE requested
    - MINOR: quic: fix room check if padding requested
    - MINOR: quic: fix TP reject on invalid max-ack-delay
    - MINOR: quic: reject invalid max_udp_payload size
    - MINOR: quic: reject retry_source_cid TP on server side
    - MINOR: quic: use proper error code on invalid received TP value
    - MINOR: quic: use proper error code on invalid server TP
    - MINOR: quic: use proper error code on missing CID in TPs
    - MINOR: quic: wrong QUIC_FT_CONNECTION_CLOSE(0x1c) frame encoding
    - MINOR: resolvers: always normalize FQDN from response
    - MINOR: server: Update healthcheck when server settings are changed via CLI
    - MINOR: sink: detect and warn when using "send-proxy" options with ring servers
    - MINOR: stick-table: cap sticky counter idx with tune.nb_stk_ctr instead of MAX_SESS_STKCTR
    - MINOR: stream: Avoid recursive evaluation for unique-id based on itself
    - MINOR: threads: fix soft-stop without multithreading support
    - BUILD: acl: silence a possible null deref warning in parse_acl_expr()
    - BUILD: compat: always set _POSIX_VERSION to ease comparisons
    - BUILD: makefile: enable backtrace by default on musl
    - CI: vtest: Rely on VTest2 to run regression tests
    - CLEANUP: dns: remove unused dns_stream_server struct member
    - CLEANUP: quic: Useless BIO_METHOD initialization
    - DOC: config: clarify some known limitations of the json_query() converter
    - DOC: config: prefer-last-server: add notes for non-deterministic algorithms
    - DOC: config: recommend disabling libc-based resolution with resolvers
    - DOC: config: recommend single quoting passwords
    - DOC: config: restore default values for resolvers hold directive
    - DOC: configuration: add details on prefer-client-ciphers
    - DOC: configuration: confuse "strict-mode" with "zero-warning"
    - DOC: Fix 'jwt_verify' converter doc
    - DOC: hlua: Add a note to warn user about httpclient object reuse
    - DOC: hlua: fix a few typos in HTTPMessage.set_body_len() documentation
    - DOC: list missing global QUIC settings
    - DOC: management: clarify usage of -V with -c
    - DOC: management: fix typo in commit f4f93c56
    - DOC: ring: refer to newer RFC5424
    - DOC: unreliable sockpair@ on macOS
    - MEDIUM: hlua: Add function to change the body length of an HTTP Message
    - MINOR: applet: add appctx_schedule() macro
    - MINOR: compiler: add __nonstring macro
    - MINOR: doc: add missing statistics column
    - MINOR: doc: add missing statistics column
    - MINOR: http: add a function to validate characters of :authority
    - MINOR: quic: Add useful error traces about qc_ssl_sess_init() failures
    - MINOR: quic: extend return value during TP parsing
    - OPTIM: check: do not delay MUX for ALPN if SSL not active
    - REGTESTS: Explicitly allow failing shell commands in some scripts
    - REGTESTS: Make the script testing conditional set-var compatible with Vtest2
    - SCRIPTS: drop the HTML generation from announce-release
    - Revert "MINOR: config/server: reject QUIC addresses"
    - Revert "BUILD: makefile: enable backtrace by default on musl"

Version-Release number of selected component (if applicable):
2.8.15

How reproducible:
Always

Steps to Reproduce:
1. Check haproxy changelog & see version
Comment 1 Raphael Gertz 2025-10-16 12:02:50 CEST
type: bugfix
subject: Updated haproxy packages fix some bugs
src:
  9:
   core:
     - haproxy-2.8.16-1.mga9
description: |
  Haproxy has a critical, a major, few medium and few minor bugs fixed in the
  last upstream version 2.8.16 of branch 2.8.

  Fixed critical bug list:
  - mjson: fix possible DoS when parsing numbers

  Fixed major bug list:
  - listeners: transfer connection accounting when switching listeners

  Fixed medium bugs list:
  - check: Requeue healthchecks on I/O events to handle check timeout
  - check: Set SOCKERR by default when a connection error is reported
  - checks: fix ALPN inheritance from server
  - dns: Reset reconnect tempo when connection is finally established
  - fd: Use the provided tgid in fd_insert() to get tgroup_info
  - h1: Allow reception if we have early data
  - h1/h2/h3: reject forbidden chars in the Host header field
  - h2/h3: reject some forbidden chars in :authority before reassembly
  - hlua: Add function to change the body length of an HTTP Message
  - hlua: Forbid any L6/L7 sample fetche functions from lua services
  - hlua: Report to SC when data were consumed on a lua socket
  - hlua: Report to SC when output data are blocked on a lua socket
  - http-client: Ask for more room when request data cannot be xferred
  - http-client: Don't wake http-client applet if nothing was xferred
  - http-client: Drain the request if an early response is received
  - http-client: Notify applet has more data to deliver until the EOM
  - http-client: Properly inc input data when HTX blocks are xferred
  - http-client: Test HTX_FL_EOM flag before commiting the HTX buffer
  - httpclient: Throw an error if an lua httpclient instance is reused
  - mux-h2: Properly handle connection error during preface sending
  - server: Duplicate healthcheck's alpn inherited from default server
  - ssl: ca-file directory mode must read every certificates of a file
  - ssl/clienthello: ECDSA with ssl-max-ver TLSv1.2 and no ECDSA ciphers
  - ssl: create the mux immediately on early data
  - ssl: Fix 0rtt to the server
  - ssl: fix build with AWS-LC
  - threads: Disable the workaround to load libgcc_s on macOS
references:
 - https://bugs.mageia.org/show_bug.cgi?id=34673
 - https://www.haproxy.org/download/2.8/src/CHANGELOG

Keywords: (none) => advisory

Comment 2 Raphael Gertz 2025-10-16 12:03:55 CEST
Previous update tickets:
https://bugs.mageia.org/show_bug.cgi?id=33475
https://bugs.mageia.org/show_bug.cgi?id=33593
https://bugs.mageia.org/show_bug.cgi?id=33820
https://bugs.mageia.org/show_bug.cgi?id=34105
https://bugs.mageia.org/show_bug.cgi?id=34599

Packages built and uploaded, advisory available.

QA should just have to double check, validate update or report if there is something wrong.

Packages in 9/core/updates_testing
i586:
haproxy-2.8.16-1.mga9.i586.rpm
haproxy-noquic-2.8.16-1.mga9.i586.rpm
haproxy-quic-2.8.16-1.mga9.i586.rpm
haproxy-utils-2.8.16-1.mga9.i586.rpm

x86_64:
haproxy-2.8.16-1.mga9.x86_64.rpm
haproxy-noquic-2.8.16-1.mga9.x86_64.rpm
haproxy-quic-2.8.16-1.mga9.x86_64.rpm
haproxy-utils-2.8.16-1.mga9.x86_64.rpm

From SRPMS:
haproxy-2.8.16-1.mga9
Comment 3 Raphael Gertz 2025-10-16 12:08:59 CEST
$ systemctl status haproxy.service
● haproxy.service - HAproxy Loadbalancer
     Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled; preset: disabled)
     Active: active (running) since XXX XXXX-XX-XX XX:XX:XX CEST; X days ago
    Process: XXXXXX ExecStartPre=/usr/sbin/haproxy-check (code=exited, status=0/SUCCESS)
   Main PID: XXXXXX (haproxy)
     Status: "Ready."
      Tasks: X (limit: 65000)
     Memory: X.XG
        CPU: Xh Xmin X.XXXs
     CGroup: /system.slice/haproxy.service
             ├─XXXXXX /usr/sbin/haproxy -f /etc/haproxy/haproxy.conf -Ws
             └─XXXXXX /usr/sbin/haproxy -f /etc/haproxy/haproxy.conf -Ws

$ curl -I http://127.0.0.1:8000
HTTP/1.1 302 Found
content-length: 0
location: https://127.0.0.1:8000/
cache-control: no-cache
alt-svc: h3=":443"; ma=3600

$ curl -I -k https://127.0.0.1:8000
HTTP/2 200
date: Thu, 16 Oct 2025 10:06:54 GMT
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=3600

$ rpm -qa | grep haproxy
haproxy-quic-2.8.16-1.mga9
haproxy-2.8.16-1.mga9

CC: (none) => andrewsfarm, mageia
Whiteboard: (none) => MGA9-64-OK
Assignee: bugsquad => qa-bugs

Comment 4 Thomas Andrews 2025-10-19 02:18:16 CEST
Tested in a VirtualBox guest. No installation issues.

[root@localhost ~]# systemctl start haproxy
[root@localhost ~]# systemctl status haproxy
● haproxy.service - HAproxy Loadbalancer
     Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled; preset: disabled)
     Active: active (running) since Sat 2025-10-18 20:11:26 EDT; 16s ago
    Process: 8483 ExecStartPre=/usr/sbin/haproxy-check (code=exited, status=0/SUCCESS)
   Main PID: 8489 (haproxy)
     Status: "Ready."
      Tasks: 9 (limit: 65000)
     Memory: 25.9M
        CPU: 345ms
     CGroup: /system.slice/haproxy.service
             ├─8489 /usr/sbin/haproxy -f /etc/haproxy/haproxy.conf -Ws
             └─8492 /usr/sbin/haproxy -f /etc/haproxy/haproxy.conf -Ws

Oct 18 20:11:26 localhost.localdomain systemd[1]: Starting haproxy.service...
Oct 18 20:11:26 localhost.localdomain systemd[1]: Started haproxy.service.
[root@localhost ~]# curl -I http://127.0.0.1:8000
HTTP/1.1 302 Found
content-length: 0
location: https://127.0.0.1:8000/
cache-control: no-cache

[root@localhost ~]# curl -I -k https://127.0.0.1:8000
HTTP/2 503 
cache-control: no-cache
content-type: text/html

Seems OK. Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 5 Dan Fandrich 2025-10-20 20:55:02 CEST
At least one of these issues (the mjson one) looks to have been assigned a CVE (CVE-2025-11230) and if so, this should be treated as a security issue and not a plain bug fix. See https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability

CC: (none) => dan
Status: NEW => ASSIGNED

Comment 6 katnatek 2025-10-21 03:06:29 CEST
Advisory type changed

CVE: (none) => CVE-2025-11230
Component: RPM Packages => Security
QA Contact: (none) => security

Comment 7 Raphael Gertz 2025-10-21 17:34:49 CEST
Thanks Dan, Katnatek and Thomas, may it be validated ?

Sorry, I missed the CVE.

I am unaware of the process difference with security updates instead of bugfix.
Comment 8 Mageia Robot 2025-10-22 22:08:27 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0242.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.