OESA-2021-1333

Dashboard / Vulnerabilities / OESA-2021-1333

OESA-2021-1333

Summary: haproxy security update

Details: HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fix(es): An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.(CVE-2021-39240) An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.(CVE-2021-39241) An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority is mishandled.(CVE-2021-39242)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1333, https://nvd.nist.gov/vuln/detail/CVE-2021-39240, https://nvd.nist.gov/vuln/detail/CVE-2021-39241, https://nvd.nist.gov/vuln/detail/CVE-2021-39242