CVE-2021-39241

An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is possible that a server would interpret this as a request for that protected resource, such as in the GET /admin? HTTP/1.1 /static/images HTTP/1.1 example.

Affected Software

Name	Vendor	Start Version	End Version
Haproxy	Haproxy	2.0.0 (including)	2.0.24 (excluding)
Haproxy	Haproxy	2.2.0 (including)	2.2.16 (excluding)
Haproxy	Haproxy	2.3.0 (including)	2.3.13 (excluding)
Haproxy	Haproxy	2.4.0 (including)	2.4.3 (excluding)
Red Hat OpenShift Container Platform 4.6	RedHat	haproxy-0:2.0.16-4.el8	*
Red Hat OpenShift Container Platform 4.7	RedHat	haproxy-0:2.0.19-2.el8	*
Red Hat OpenShift Container Platform 4.8	RedHat	haproxy-0:2.2.13-2.el7	*
Red Hat OpenShift Container Platform 4.9	RedHat	haproxy-0:2.2.15-2.el8	*
Haproxy	Ubuntu	devel	*
Haproxy	Ubuntu	esm-infra/focal	*
Haproxy	Ubuntu	focal	*
Haproxy	Ubuntu	hirsute	*
Haproxy	Ubuntu	impish	*
Haproxy	Ubuntu	jammy	*
Haproxy	Ubuntu	trusty	*
Haproxy	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-39241
CWE	https://cwe.mitre.org/data/definitions/.html

Affected Software

References