HA-Proxy version 1.5.4 2014/09/02 about docker-haproxy

[ryzy]

Hi,

This is the version from EPEL CentOS repository, so that's what's installed inside the image, sorry... ;)

If you care to, you could go to the package maintainer and ask him/her to update it there... But from what I see in the changelog there are only minor/cosmetic fixes, no new functionality has been added - so in a way I'm not so surprised that nobody is in a rush to update it.

[blop]

Indeed.

I'm using the new ssl-default-bind-options option which were added in 1.5.7.
So I had to switch to the https://registry.hub.docker.com/_/haproxy/ image.

[blop]

July, 3rd, 2015 : 1.5.14 : fixes an information leak vulnerability (CVE-2015-3281)

A vulnerability was found when HTTP pipelining is used. In some cases, a client might be able to cause a buffer alignment issue and retrieve uninitialized memory contents that exhibit data from a past request or session. I want to address sincere congratulations to Charlie Smurthwaite of aTech Media for the really detailed traces he provided which made it possible to find the cause of this bug. Every user of 1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev snapshot to fix this issue, or use the backport of the fix provided by their operating system vendors. CVE-2015-3281 was assigned to this bug. Code and changelog are available here as usual.

see http://www.haproxy.org/

[pozgo]

Hi @blop
I have sent PR with fix for this. Now just need to wait for @ryzy to have a look and if all good he will merge it.

From now on I think we will build HAProxy from source. I'll add tags to Docker Hub so you could specify version of HAProxy you would want to run. i.e docker run -d million12/haproxy:1.5.14

[pozgo]

Fixed by e0d78b3734e9c49ca0c0ebbef9e44dd5e0a8e8da