CVE-2021-40346
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.
Paquets affectés
Bitnami
haproxy
[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.25"},{"introduced":"2.2.0"},{"fixed":"2.2.17"},{"introduced":"2.3.0"},{"fixed":"2.3.14"},{"introduced":"2.4.0"},{"fixed":"2.4.4"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2021-40346 haproxy Corrigé dans: 2.2.16-3
Références
- advisory git.haproxy.org
- advisory github.com
- advisory jfrog.com
- advisory debian.org
- web lists.apache.org
- web lists.apache.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web mail-archive.com
- web mail-archive.com
- web nvd.nist.gov