PT-2021-7493 · Haproxy+2 · Haproxy+2

Tim Düsterhus · Published 2021-08-11 · Updated 2024-03-06 · CVE-2021-39242

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions HAProxy versions 2.2 before 2.2.16 HAProxy versions 2.3 before 2.3.13 HAProxy versions 2.4 before 2.4.3

Description The issue is related to a mismatch between Host and authority being mishandled, which can lead to an attacker-controlled HTTP Host header. This can allow a remote attacker to impact data integrity.

Recommendations For HAProxy versions 2.2 before 2.2.16, update to version 2.2.16 or later. For HAProxy versions 2.3 before 2.3.13, update to version 2.3.13 or later. For HAProxy versions 2.4 before 2.4.3, update to version 2.4.3 or later.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

ALT-PU-2022-3040

ALT-PU-2023-1151

BDU:2022-06897

BIT-HAPROXY-2021-39242

CVE-2021-39242

DSA-4960-1

OESA-2021-1333

RHSA-2021:4118

RHSA-2021:5208

Affected Products

Alt Linux

Astra Linux

Haproxy

References · 26

• 🔥 https://mail-archive.com/[e-mail]/msg41041.html · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39242 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-haproxy-2021-39242 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39242 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1110SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4960-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-39242 · Vendor Advisory
• https://debian.org/security/2021/dsa-4960 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20221220SE16 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-39242 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39241 · Security Note