CVE-2021-39240 Affecting haproxy package, versions <2.2.9-2+deb11u1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-HAPROXY-1566773
- published 18 Aug 2021
- disclosed 17 Aug 2021
Introduced: 17 Aug 2021
CVE-2021-39240 Open this link in a new tabHow to fix?
Upgrade Debian:11 haproxy to version 2.2.9-2+deb11u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream haproxy package and not the haproxy package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.
References
- https://security-tracker.debian.org/tracker/CVE-2021-39240
- https://www.debian.org/security/2021/dsa-4960
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=4b8852c70d8c4b7e225e24eb58258a15eb54c26e
- https://git.haproxy.org/?p=haproxy.git;a=commit;h=a495e0d94876c9d39763db319f609351907a31e8
- https://www.mail-archive.com/haproxy@formilux.org/msg41041.html
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=4b8852c70d8c4b7e225e24eb58258a15eb54c26e
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=a495e0d94876c9d39763db319f609351907a31e8
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
- https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html