CVE-2021-39240
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-39240
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-39240.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-39240
- Aliases
- Related
- Published
- 2021-08-17T19:15:08Z
- Modified
- 2025-02-14T11:30:02.422804Z
- Downstream
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.
- References
-
- https://www.debian.org/security/2021/dsa-4960
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=4b8852c70d8c4b7e225e24eb58258a15eb54c26e
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=a495e0d94876c9d39763db319f609351907a31e8
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
- https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html
- https://security-tracker.debian.org/tracker/CVE-2021-39240
Affected packages
Debian:11 / haproxy
Package
- Name
- haproxy
- Purl
- pkg:deb/debian/haproxy?arch=source
Debian:12 / haproxy
Package
- Name
- haproxy
- Purl
- pkg:deb/debian/haproxy?arch=source
Debian:13 / haproxy
Package
- Name
- haproxy
- Purl
- pkg:deb/debian/haproxy?arch=source
Git / git.haproxy.org/haproxy-2.2.git
Affected ranges
- Type
- GIT
- Repo
- https://git.haproxy.org/haproxy-2.2.git
- Events
-
Introduced3a00c915fd241fc398a080a11ccac9c5c46791ceFixedd34216bf97346ab6783ed877b8137cd31b8494c1
- Type
- GIT
- Repo
- https://git.haproxy.org/haproxy-2.3.git
- Events
-
Introduced1c0a722a83e7c45456a2b82c15889ab9ab5c4948Fixedce43e1d18914d582dcabf63607548e5ecb65ebd0
- Type
- GIT
- Repo
- https://github.com/haproxy/haproxy
- Events