Date: Thu, 29 Jan 2015 08:48:49 -0800 From: Qualys Security Advisory <qsa@...lys.com> To: oss-security@...ts.openwall.com Subject: Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Dear All, We were asked off-list whether HAProxy is vulnerable to GHOST or not, and thought others might be interested in the answer as well. The short version is: HAProxy is NOT vulnerable to GHOST. The slightly longer version is: we are looking for gethostbyname() calls whose hostname argument can be controlled by an attacker. There are indeed a few calls to gethostbyname() in HAProxy, but their hostname arguments all depend on the configuration file, in the end, so they are safe (side note: there is getaddrinfo() support too, but it seems to be turned on for Solaris only, by default). Hope this is useful. With best regards, -- the Qualys Security Advisory team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.