CVE-2021-39240

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of...

Original description

The description as published by the source.

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami haproxy

[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.16"},{"introduced":"2.3.0"},{"fixed":"2.3.13"},{"introduced":"2.4.0"},{"fixed":"2.4.3"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2021-39240 haproxy Fixed in: 2.2.16-1

References

advisory debian.org
web git.haproxy.org
web git.haproxy.org
web lists.fedoraproject.org
web lists.fedoraproject.org
web mail-archive.com
web nvd.nist.gov