NVD Vulnerability Detail

CVE-2021-39240

Summary	An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to achieve.
Publication Date	Aug. 18, 2021, 4:15 a.m.
Registration Date	Aug. 18, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:18 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:11.0:::::::*

Related information, measures and tools

No	URL	タグ
1	https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=4b8852c70d8c4b7e225e24eb58258a15eb54c26e
2	https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=4b8852c70d8c4b7e225e24eb58258a15eb54c26e
3	https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=a495e0d94876c9d39763db319f609351907a31e8
4	https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=a495e0d94876c9d39763db319f609351907a31e8
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
9	https://www.debian.org/security/2021/dsa-4960	Third Party Advisory
10	https://www.debian.org/security/2021/dsa-4960	Third Party Advisory
11	https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html
12	https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html

Common Vulnerabilities List

JVN Vulnerability Information

HAProxy における脆弱性

Title	HAProxy における脆弱性
Summary	HAProxy には、不特定の脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 17, 2021, midnight
Registration Date	July 11, 2022, 3:46 p.m.
Last Update	July 11, 2022, 3:46 p.m.

Affected System

Debian

Debian GNU/Linux

Fedora Project

Fedora

Willy Tarreau

HAProxy 2.2 以上 2.2.16 未満

HAProxy 2.3 以上 2.3.13 未満

HAProxy 2.4 以上 2.4.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-39240	https://www.cve.org/CVERecord?id=CVE-2021-39240
National Vulnerability Database (NVD)
2	CVE-2021-39240	https://nvd.nist.gov/vuln/detail/CVE-2021-39240

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-4960-1	https://www.debian.org/security/2021/dsa-4960
Fedora Update Notification
2	FEDORA-2021-3ab4512c98	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
3	FEDORA-2021-e6557245e8	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/
Git
4	BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax	https://git.haproxy.org/?p=haproxy.git;a=commit;h=a495e0d94876c9d39763db319f609351907a31e8
5	BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it	https://git.haproxy.org/?p=haproxy.git;a=commit;h=4b8852c70d8c4b7e225e24eb58258a15eb54c26e
The Mail Archive
6	[ANNOUNCE] HTTP/2 vulnerabilities from 2.0 to 2.5-dev	https://www.mail-archive.com/haproxy@formilux.org/msg41041.html

Change Log

No	Changed Details	Date of change
1	[2022年07月11日] 掲載	July 11, 2022, 3:46 p.m.