PT-2021-7625 · Haproxy+2 · Haproxy+2

Tim Düsterhus · Published 2021-08-11 · Updated 2024-03-06 · CVE-2021-39241

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HAProxy versions 2.0 through 2.0.23 HAProxy versions 2.2 through 2.2.15 HAProxy versions 2.3 through 2.3.12 HAProxy versions 2.4 through 2.4.2

Description The issue is related to insufficient input validation in the HAProxy HTTP server software. This allows a remote attacker to impact data integrity. Specifically, an HTTP method name may contain a space followed by the name of a protected resource, which could be interpreted by the server as a request for that protected resource. For example, a request like "GET /admin? HTTP/1.1 /static/images HTTP/1.1" could be misinterpreted.

Recommendations For HAProxy versions 2.0 through 2.0.23, update to version 2.0.24 or later. For HAProxy versions 2.2 through 2.2.15, update to version 2.2.16 or later. For HAProxy versions 2.3 through 2.3.12, update to version 2.3.13 or later. For HAProxy versions 2.4 through 2.4.2, update to version 2.4.3 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2022-3040

ALT-PU-2023-1151

ALT-PU-2023-5100

BDU:2023-00287

BIT-HAPROXY-2021-39241

CVE-2021-39241

DSA-4960-1

OESA-2021-1333

RHSA-2021:4118

RHSA-2021:5208

RHSA-2022:0024

RHSA-2022:0114

USN-5042-1

Affected Products

Alt Linux

Astra Linux

Haproxy

References · 32

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39241 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0131SE47MD · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5042-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39241 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-39241 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39242 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-39241 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-39241 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5042-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4960-1 · Vendor Advisory
• https://debian.org/security/2021/dsa-4960 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39241 · Vendor Advisory