CVE-2021-39240: High severity HAProxy HAProxy vulnerability
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/haproxyto a version that resolves this vulnerability.Fixed in 1.8.19-1+deb10u3Fixed in 1.8.19-1+deb10u4Fixed in 2.2.9-2+deb11u5Fixed in 2.6.12-1Fixed in 2.6.15-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in HAProxy?
The vulnerability ID is CVE-2021-39240.
What are the affected versions of HAProxy?
HAProxy versions 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3 are affected.
What is the severity level of CVE-2021-39240?
The severity level of CVE-2021-39240 is high with a CVSS score of 7.5.
How does CVE-2021-39240 impact HAProxy?
CVE-2021-39240 allows an attacker to bypass routing rules and affect the scheme and path portions of a URI in HAProxy.
Is there a fix available for CVE-2021-39240?
Yes, fix versions are available. Please update to HAProxy version 2.2.16, 2.3.13, or 2.4.3 or later.