This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-39241 →

DEBIAN-CVE-2021-39241

An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a sp...

Original description

The description as published by the source.

An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 haproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}]

Debian:13 haproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}]

Debian:14 haproxy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.16-1"}]}]

References

advisory security-tracker.debian.org