This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-39240 →

DEBIAN-CVE-2021-39240

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of...

Original description

The description as published by the source.

An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 haproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}]

Debian:13 haproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}]

Debian:14 haproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}]

References

advisory security-tracker.debian.org