PT-2021-7490 · Haproxy+5 · Haproxy+5
Ori Hollander
·
Published
2021-09-07
·
Updated
2024-06-15
·
CVE-2021-40346
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
HAProxy versions 2.0 through 2.5
Description
An integer overflow exists in the
htx add header function that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs. This issue affects the integrity of data and can be exploited by a remote attacker.Recommendations
For HAProxy versions 2.0 through 2.5, consider disabling the
htx add header function until a patch is available to prevent HTTP request smuggling attacks. Restrict access to the htx add header function to minimize the risk of exploitation. Avoid using the htx add header function in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Haproxy
Linuxmint
Suse
Ubuntu