NetSight
IP …
medium5.3

CVE-2021-39241

An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3.

Impact

An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the "GET /admin? HTTP/1.1 /static/images HTTP/1.1" example.

Affected products

VendorProductAffected versions
HaproxyHaproxy
from 2.0.0 before 2.0.24
from 2.2.0 before 2.2.16
from 2.3.0 before 2.3.13
from 2.4.0 before 2.4.3
DebianDebian Linux
Version 11.0
FedoraprojectFedora
Versions 33, 34

References