Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2021-40346

Опубликовано: 08 сент. 2021
Источник: redhat
CVSS3: 7.5

Описание

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while parsing an HTTP request. The highest threat from this vulnerability is integrity.

Меры по смягчению последствий

To mitigate this problem the following can be added to proxy config: http-request deny if { req.hdr_cnt(content-length) gt 1 } http-response deny if { res.hdr_cnt(content-length) gt 1 }

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6haproxyNot affected
Red Hat Enterprise Linux 7haproxyNot affected
Red Hat Enterprise Linux 8haproxyNot affected
Red Hat Enterprise Linux 9haproxyNot affected
Red Hat OpenShift Container Platform 3.11haproxyOut of support scope
Red Hat Software Collectionsrh-haproxy18-haproxyNot affected
Red Hat OpenShift Container Platform 4.6haproxyFixedRHSA-2022:002412.01.2022
Red Hat OpenShift Container Platform 4.7haproxyFixedRHSA-2022:011419.01.2022
Red Hat OpenShift Container Platform 4.8haproxyFixedRHSA-2021:520805.01.2022
Red Hat OpenShift Container Platform 4.9haproxyFixedRHSA-2021:411810.11.2021

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-444
https://bugzilla.redhat.com/show_bug.cgi?id=2000599haproxy: request smuggling attack or response splitting via duplicate content-length header

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 7.5
ubuntu
больше 4 лет назад

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

CVSS3: 7.5
nvd
больше 4 лет назад

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

CVSS3: 7.5
debian
больше 4 лет назад

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_heade ...

suse-cvrf
больше 4 лет назад

Security update for haproxy

suse-cvrf
больше 4 лет назад

Security update for haproxy

7.5 High

CVSS3