CVE-2021-39241
An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a sp...
Original description
The description as published by the source.
An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.
Affected packages
Bitnami
haproxy
[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.24"},{"introduced":"2.2.0"},{"fixed":"2.2.16"},{"introduced":"2.3.0"},{"fixed":"2.3.13"},{"introduced":"2.4.0"},{"fixed":"2.4.3"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-39241 haproxy Fixed in: 2.2.16-1
References
- advisory debian.org
- web git.haproxy.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web mail-archive.com
- web nvd.nist.gov