ID

VAR-202109-1900


CVE

CVE-2021-40346


TITLE

HAProxy Input Validation Error Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2022-05867

DESCRIPTION

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs. HAProxy is an open source TCP/HTTP load balancing server from the French HAProxy= company. = There is an input validation error vulnerability in HAProxy, which stems from the lack of header name length checking in the htx_add_header() and htx_add_trailer() functions in HAProxy, which can be exploited by attackers to cause request smuggling attacks or response splitting attacks. Description: Red Hat Advanced Cluster Management for Kubernetes 2.2.11 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console — with security policy built in. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.2/html/release_notes/ Security updates: * object-path: Type confusion vulnerability can lead to a bypass of CVE-2020-15256 (CVE-2021-23434) * follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155) Related bugs: * RHACM 2.2.11 images (Bugzilla #2029508) * ClusterImageSet has 4.5 which is not supported in ACM 2.2.10 (Bugzilla #2030859) 3. Bugs fixed (https://bugzilla.redhat.com/): 1999810 - CVE-2021-23434 object-path: Type confusion vulnerability can lead to a bypass of CVE-2020-15256 2029508 - RHACM 2.2.11 images 2030859 - ClusterImageSet has 4.5 which is not supported in ACM 2.2.10 2044556 - CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor 5. Bugs fixed (https://bugzilla.redhat.com/): 2050826 - CVE-2022-24348 gitops: Path traversal and dereference of symlinks when passing Helm value files 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift Container Platform 4.9.6 packages and security update Advisory ID: RHSA-2021:4118-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2021:4118 Issue date: 2021-11-10 CVE Names: CVE-2021-39240 CVE-2021-39241 CVE-2021-39242 CVE-2021-40346 ===================================================================== 1. Summary: Red Hat OpenShift Container Platform release 4.9.6 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenShift Container Platform 4.9 - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.9.6. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHBA-2021:4119 Security Fix(es): * haproxy: does not ensure that the scheme and path portions of a URI have the expected characters (CVE-2021-39240) * haproxy: an HTTP method name may contain a space followed by the name of a protected resource (CVE-2021-39241) * haproxy: it can lead to a situation with an attacker-controlled HTTP Host header because a mismatch between Host and authority is mishandled (CVE-2021-39242) * haproxy: request smuggling attack or response splitting via duplicate content-length header (CVE-2021-40346) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.9 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.9/updating/updating-cluster - -between-minor.html#understanding-upgrade-channels_updating-cluster-between - -minor 4. Solution: For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-rel ease-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.9/updating/updating-cluster - -cli.html 5. Bugs fixed (https://bugzilla.redhat.com/): 1995104 - CVE-2021-39240 haproxy: does not ensure that the scheme and path portions of a URI have the expected characters 1995107 - CVE-2021-39241 haproxy: an HTTP method name may contain a space followed by the name of a protected resource 1995112 - CVE-2021-39242 haproxy: it can lead to a situation with an attacker-controlled HTTP Host header because a mismatch between Host and authority is mishandled 2000599 - CVE-2021-40346 haproxy: request smuggling attack or response splitting via duplicate content-length header 6. Package List: Red Hat OpenShift Container Platform 4.9: Source: cri-o-1.22.0-91.rhaos4.9.gitd745cab.el7.src.rpm openshift-4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el7.src.rpm x86_64: cri-o-1.22.0-91.rhaos4.9.gitd745cab.el7.x86_64.rpm cri-o-debuginfo-1.22.0-91.rhaos4.9.gitd745cab.el7.x86_64.rpm openshift-hyperkube-4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el7.x86_64.rpm Red Hat OpenShift Container Platform 4.9: Source: cri-o-1.22.0-78.rhaos4.9.gitd745cab.el8.src.rpm haproxy-2.2.15-2.el8.src.rpm openshift-4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.src.rpm openshift-kuryr-4.9.0-202110281423.p0.git.4595a4e.assembly.stream.el8.src.rpm openstack-ironic-18.1.1-0.20211019162143.e0437cd.el8.src.rpm aarch64: cri-o-1.22.0-78.rhaos4.9.gitd745cab.el8.aarch64.rpm cri-o-debuginfo-1.22.0-78.rhaos4.9.gitd745cab.el8.aarch64.rpm cri-o-debugsource-1.22.0-78.rhaos4.9.gitd745cab.el8.aarch64.rpm haproxy-debugsource-2.2.15-2.el8.aarch64.rpm openshift-hyperkube-4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.aarch64.rpm noarch: openshift-kuryr-cni-4.9.0-202110281423.p0.git.4595a4e.assembly.stream.el8.noarch.rpm openshift-kuryr-common-4.9.0-202110281423.p0.git.4595a4e.assembly.stream.el8.noarch.rpm openshift-kuryr-controller-4.9.0-202110281423.p0.git.4595a4e.assembly.stream.el8.noarch.rpm openstack-ironic-api-18.1.1-0.20211019162143.e0437cd.el8.noarch.rpm openstack-ironic-common-18.1.1-0.20211019162143.e0437cd.el8.noarch.rpm openstack-ironic-conductor-18.1.1-0.20211019162143.e0437cd.el8.noarch.rpm python3-ironic-tests-18.1.1-0.20211019162143.e0437cd.el8.noarch.rpm python3-kuryr-kubernetes-4.9.0-202110281423.p0.git.4595a4e.assembly.stream.el8.noarch.rpm ppc64le: cri-o-1.22.0-78.rhaos4.9.gitd745cab.el8.ppc64le.rpm cri-o-debuginfo-1.22.0-78.rhaos4.9.gitd745cab.el8.ppc64le.rpm cri-o-debugsource-1.22.0-78.rhaos4.9.gitd745cab.el8.ppc64le.rpm haproxy-debugsource-2.2.15-2.el8.ppc64le.rpm openshift-hyperkube-4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.ppc64le.rpm s390x: cri-o-1.22.0-78.rhaos4.9.gitd745cab.el8.s390x.rpm cri-o-debuginfo-1.22.0-78.rhaos4.9.gitd745cab.el8.s390x.rpm cri-o-debugsource-1.22.0-78.rhaos4.9.gitd745cab.el8.s390x.rpm haproxy-debugsource-2.2.15-2.el8.s390x.rpm openshift-hyperkube-4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.s390x.rpm x86_64: cri-o-1.22.0-78.rhaos4.9.gitd745cab.el8.x86_64.rpm cri-o-debuginfo-1.22.0-78.rhaos4.9.gitd745cab.el8.x86_64.rpm cri-o-debugsource-1.22.0-78.rhaos4.9.gitd745cab.el8.x86_64.rpm haproxy-debugsource-2.2.15-2.el8.x86_64.rpm openshift-hyperkube-4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-39240 https://access.redhat.com/security/cve/CVE-2021-39241 https://access.redhat.com/security/cve/CVE-2021-39242 https://access.redhat.com/security/cve/CVE-2021-40346 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYx8gNzjgjWX9erEAQjjTg/5AXMVm45fYdpV7EOawTw6ADN3G+MIC9F+ 4/Yi3cEdClLzvColFg9mR8Ha/HrtSc8hl/ImYCdWpdaAgR69Z2ReFYR8skd6IQlg 2yqP8Fv34dXLxMkTgFpf2P4xsVdvAaKW5LXuZZ8tNYIRmCFmDJLbO1lyAAb0f7Tg cYFQE5LsuBSFceuY405VYjdwrAR1N/EwzleqpTrgcdeGliwRnfpiOjTs9rXgIIkf EFccGSIJpvlsibKm78o8PVxpoKmwRPnIUU/lOlLEsx4epYEal332i/JOhctXQ0MD KIPy0Ghto00KDyBfp1JziS3by4TD3DPYoZ2LqlmN844BUc4de7h/48gwy8n3PK7g A+0sguS3K4lTrb0INV6f3fPBsULZSAAhuPMkpAf0YgfnLdJlkm+oXBWDyiERZyaX lcQREEMJoKWnw5s83ip+o+QQdisxQ5olqEMD6g0qT9msUvgha4OIEgnN1dYgFvEK IY3zgShDHQGg2LwAXku1pvEB+N5MedDM/4OWV7qhFUN1edlTePGqN8tIE/bgEpib 464s1Q3FMcTwQDOmKpTh5GTt8TKkuNIibfHFqqwEJ/L/1L77qDjtp4EapFm0USxq 0R/bVd733gsEXghAv1NRBHQECb727Fne6cNLu+TffFQbtfSel+0MGogsSURVhy7e 7lkzoAA4Wc4= =r4tE -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Bugs fixed (https://bugzilla.redhat.com/): 2034067 - CVE-2021-45105 log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4968-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso September 07, 2021 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : haproxy CVE ID : CVE-2021-40346 Ori Hollander reported that missing header name length checks in the htx_add_header() and htx_add_trailer() functions in HAProxy, a fast and reliable load balancing reverse proxy, could result in request smuggling attacks or response splitting attacks. Additionally this update addresses #993303 introduced in DSA 4960-1 causing HAProxy to fail serving URLs with HTTP/2 containing '//'. For the stable distribution (bullseye), this problem has been fixed in version 2.2.9-2+deb11u2. We recommend that you upgrade your haproxy packages. For the detailed security status of haproxy please refer to its security tracker page at: https://security-tracker.debian.org/tracker/haproxy Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmE30edfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0QPzQ//Xl1VpOHuAwqodHnEx3DSP172eZ6lD3Mdrs+GXscbkCXTMHduSXGnSGA3 N1IrN8Wt1bfvxybqdR3CLTehTzmgBJLGEz8Ub5gu0IJ2o1edyiqpZBDhZvDSCPFC iFHWucZ2asOb9c/rCapTi7AD+S7NpC5AnIGfNhUHYWnFwR7Id8gHvd9JaHUGrInh P4T5lzY70fvNFPrSye7CQFPcSScHOe29i7igKXZmV+FxvnYEYJyavf6ijwGTJF87 e1lJAm8er9bQZp3GLzkbI3bRUDmO+IgGX+H3Qz/PxbU23PhyDN91QVWCY/CX11nN yH4evBchPM1ap2o8hPZYpUYUznYekOA1CfYxTcuP5oc9QFMEzHMNUVhSihsjGA4Y fCxFmdhcQzTLI7GcZTkSB2k0CikF4ncH7aqtM7oK2z/CM/uJeVO1WzRtvyJKuD72 Lv6PwQ/AbMa/dKYzROyQE0vDzRd23UzlQzg1npbpHlfPYXOgyfIRLCIfBPatyGrR snpdsNnGejesNmsbxCBwQGz2jsrgSqMe1qkho9ebK3aeaSA1lRe+WXV87NYH2wZi JOQH9JjqXCwkH/JDoOBWasOAhyKPs4jv1JT2L2iXCNVbFcgklnc+iaUgafYV9tob QMoc5oZREvgkpu+TOOTOBmrOw4sDfEOgcNf3G1sBBFKS4ds5wv0= =8IRe -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2021-40346 // CNVD: CNVD-2022-05867 // VULMON: CVE-2021-40346 // PACKETSTORM: 165624 // PACKETSTORM: 165533 // PACKETSTORM: 166309 // PACKETSTORM: 166051 // PACKETSTORM: 164940 // PACKETSTORM: 165552 // PACKETSTORM: 169123

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-05867

AFFECTED PRODUCTS

vendor:haproxymodel:haproxyscope:ltversion:2.3.14

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:34

Trust: 1.0

vendor:haproxymodel:haproxyscope:ltversion:2.4.4

Trust: 1.0

vendor:haproxymodel:haproxyscope:gteversion:2.0.0

Trust: 1.0

vendor:haproxymodel:haproxyscope:ltversion:2.2.17

Trust: 1.0

vendor:haproxymodel:haproxyscope:gteversion:2.2.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:11.0

Trust: 1.0

vendor:haproxymodel:haproxyscope:gteversion:2.3.0

Trust: 1.0

vendor:haproxymodel:haproxyscope:gteversion:2.4.0

Trust: 1.0

vendor:haproxymodel:haproxyscope:ltversion:2.0.25

Trust: 1.0

vendor:haproxymodel:haproxyscope:eqversion:2.5

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:33

Trust: 1.0

vendor:haproxymodel:haproxyscope:gteversion:2.0,<=2.5

Trust: 0.6

sources: CNVD: CNVD-2022-05867 // NVD: CVE-2021-40346

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-40346
value: HIGH

Trust: 1.0

CNVD: CNVD-2022-05867
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202109-365
value: HIGH

Trust: 0.6

VULMON: CVE-2021-40346
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-40346
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2022-05867
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-40346
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2022-05867 // VULMON: CVE-2021-40346 // CNNVD: CNNVD-202109-365 // NVD: CVE-2021-40346

PROBLEMTYPE DATA

problemtype:CWE-190

Trust: 1.0

sources: NVD: CVE-2021-40346

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202109-365

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202109-365

PATCH

title:Patch for HAProxy Input Validation Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/315566

Trust: 0.6

title:Haproxy HAProxy Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=162748

Trust: 0.6

title:Debian Security Advisories: DSA-4968-1 haproxy -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=5748f9c5d3808c8bcb9436e54096d270

Trust: 0.1

title:Red Hat: CVE-2021-40346url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2021-40346

Trust: 0.1

title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2021-40346 log

Trust: 0.1

title:Amazon Linux 2: ALASHAPROXY2-2023-005url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALASHAPROXY2-2023-005

Trust: 0.1

title:Red Hat: Important: Red Hat OpenShift GitOps security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220580 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: Red Hat Advanced Cluster Management 2.2.11 security updates and bug fixesurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220856 - Security Advisory

Trust: 0.1

title:CVE-2021-40346url:https://github.com/knqyf263/CVE-2021-40346

Trust: 0.1

title:CVE-2021-40346-POCurl:https://github.com/donky16/CVE-2021-40346-POC

Trust: 0.1

sources: CNVD: CNVD-2022-05867 // VULMON: CVE-2021-40346 // CNNVD: CNNVD-202109-365

EXTERNAL IDS

db:NVDid:CVE-2021-40346

Trust: 3.0

db:PACKETSTORMid:165624

Trust: 0.7

db:PACKETSTORMid:164940

Trust: 0.7

db:PACKETSTORMid:165552

Trust: 0.7

db:CNVDid:CNVD-2022-05867

Trust: 0.6

db:PACKETSTORMid:164079

Trust: 0.6

db:PACKETSTORMid:165481

Trust: 0.6

db:AUSCERTid:ESB-2021.3002

Trust: 0.6

db:AUSCERTid:ESB-2022.1071

Trust: 0.6

db:AUSCERTid:ESB-2021.3024

Trust: 0.6

db:AUSCERTid:ESB-2021.3853

Trust: 0.6

db:AUSCERTid:ESB-2021.3263

Trust: 0.6

db:AUSCERTid:ESB-2022.0716

Trust: 0.6

db:AUSCERTid:ESB-2022.0048

Trust: 0.6

db:AUSCERTid:ESB-2022.0175

Trust: 0.6

db:AUSCERTid:ESB-2022.0238

Trust: 0.6

db:CS-HELPid:SB2022011734

Trust: 0.6

db:CS-HELPid:SB2021111101

Trust: 0.6

db:CS-HELPid:SB2022011936

Trust: 0.6

db:CS-HELPid:SB2021090814

Trust: 0.6

db:CS-HELPid:SB2022010526

Trust: 0.6

db:CNNVDid:CNNVD-202109-365

Trust: 0.6

db:VULMONid:CVE-2021-40346

Trust: 0.1

db:PACKETSTORMid:165533

Trust: 0.1

db:PACKETSTORMid:166309

Trust: 0.1

db:PACKETSTORMid:166051

Trust: 0.1

db:PACKETSTORMid:169123

Trust: 0.1

sources: CNVD: CNVD-2022-05867 // VULMON: CVE-2021-40346 // PACKETSTORM: 165624 // PACKETSTORM: 165533 // PACKETSTORM: 166309 // PACKETSTORM: 166051 // PACKETSTORM: 164940 // PACKETSTORM: 165552 // PACKETSTORM: 169123 // CNNVD: CNNVD-202109-365 // NVD: CVE-2021-40346

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2021-40346

Trust: 1.7

url:https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95

Trust: 1.6

url:https://git.haproxy.org/?p=haproxy.git

Trust: 1.6

url:https://www.debian.org/security/2021/dsa-4968

Trust: 1.6

url:https://access.redhat.com/security/cve/cve-2021-40346

Trust: 1.2

url:https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/

Trust: 1.0

url:https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120%40%3cdev.cloudstack.apache.org%3e

Trust: 1.0

url:https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a%40%3cdev.cloudstack.apache.org%3e

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/a7v2iyo22lwvbgunzwvkntmdv4kinlfo/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/mxtsby2teaxwzvfqm3cxhjfronx7pemn/

Trust: 1.0

url:https://www.mail-archive.com/haproxy%40formilux.org

Trust: 1.0

url:https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html

Trust: 1.0

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.6

url:https://bugzilla.redhat.com/):

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2021-39241

Trust: 0.6

url:https://access.redhat.com/security/team/contact/

Trust: 0.6

url:https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120@%3cdev.cloudstack.apache.org%3e

Trust: 0.6

url:https://www.mail-archive.com/haproxy@formilux.org/msg41114.html

Trust: 0.6

url:https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a@%3cdev.cloudstack.apache.org%3e

Trust: 0.6

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/a7v2iyo22lwvbgunzwvkntmdv4kinlfo/

Trust: 0.6

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/mxtsby2teaxwzvfqm3cxhjfronx7pemn/

Trust: 0.6

url:http-smuggling/

Trust: 0.6

url:https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0048

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021111101

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0175

Trust: 0.6

url:https://packetstormsecurity.com/files/165624/red-hat-security-advisory-2022-0114-04.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011936

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1071

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3002

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3024

Trust: 0.6

url:https://packetstormsecurity.com/files/164940/red-hat-security-advisory-2021-4118-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/165552/red-hat-security-advisory-2022-0026-06.html

Trust: 0.6

url:https://vigilance.fr/vulnerability/haproxy-header-injection-via-htx-36327

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3263

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3853

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011734

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021090814

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0716

Trust: 0.6

url:https://packetstormsecurity.com/files/164079/ubuntu-security-notice-usn-5063-1.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022010526

Trust: 0.6

url:https://packetstormsecurity.com/files/165481/red-hat-security-advisory-2021-5208-05.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0238

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-39241

Trust: 0.4

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.4

url:https://access.redhat.com/security/team/key/

Trust: 0.3

url:https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html

Trust: 0.2

url:https://access.redhat.com/errata/rhba-2022:0025

Trust: 0.2

url:https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-16135

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3200

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-5827

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-27645

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-27645

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-33574

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-13435

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-5827

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-28153

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-24370

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-13751

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-19603

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-35942

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-17594

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-24370

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3572

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-12762

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-36086

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-13750

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-13751

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-22898

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-12762

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-16135

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-36084

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-17594

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3800

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-36087

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3712

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3445

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-13435

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-19603

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-20231

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-22925

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-18218

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-20232

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-20838

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-22876

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-20231

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2020-14155

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-20838

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-22925

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-36085

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-33560

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-17595

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-42574

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2020-14155

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-20232

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-28153

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-13750

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3426

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2019-18218

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3580

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2019-17595

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-22898

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3521

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-22876

Trust: 0.2

url:https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0114

Trust: 0.1

url:https://access.redhat.com/errata/rhba-2022:0117

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-between-minor.html#understanding-upgrade-channels_updating-cluster-between-minor

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0024

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-0465

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-23434

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0185

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22942

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-0466

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3564

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25710

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-0920

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4122

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-25710

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-0466

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-23434

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4155

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0330

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0856

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.2/html/release_notes/index

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-25214

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-25709

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-0465

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3752

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25709

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4019

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4192

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.2/html-single/install/index#installing

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0155

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3984

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3573

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-4193

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24407

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-25214

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-0920

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-3872

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.2/html/release_notes/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-43527

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0580

Trust: 0.1

url:https://access.redhat.com/articles/11258

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-33574

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-33560

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-14145

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2016-4658

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-37750

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-20271

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-24348

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-3200

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-20271

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-44790

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-14145

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-4658

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-rel

Trust: 0.1

url:https://access.redhat.com/errata/rhba-2021:4119

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-39242

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-39240

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-39240

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-39242

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2021:4118

Trust: 0.1

url:https://docs.openshift.com/container-platform/4.9/updating/updating-cluster

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#low

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-45105

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:0026

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-45105

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://security-tracker.debian.org/tracker/haproxy

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

sources: CNVD: CNVD-2022-05867 // PACKETSTORM: 165624 // PACKETSTORM: 165533 // PACKETSTORM: 166309 // PACKETSTORM: 166051 // PACKETSTORM: 164940 // PACKETSTORM: 165552 // PACKETSTORM: 169123 // CNNVD: CNNVD-202109-365 // NVD: CVE-2021-40346

CREDITS

Red Hat

Trust: 0.6

sources: PACKETSTORM: 165624 // PACKETSTORM: 165533 // PACKETSTORM: 166309 // PACKETSTORM: 166051 // PACKETSTORM: 164940 // PACKETSTORM: 165552

SOURCES

db:CNVDid:CNVD-2022-05867
db:VULMONid:CVE-2021-40346
db:PACKETSTORMid:165624
db:PACKETSTORMid:165533
db:PACKETSTORMid:166309
db:PACKETSTORMid:166051
db:PACKETSTORMid:164940
db:PACKETSTORMid:165552
db:PACKETSTORMid:169123
db:CNNVDid:CNNVD-202109-365
db:NVDid:CVE-2021-40346

LAST UPDATE DATE

2024-11-20T20:32:55.122000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-05867date:2022-01-23T00:00:00
db:VULMONid:CVE-2021-40346date:2023-11-07T00:00:00
db:CNNVDid:CNNVD-202109-365date:2022-03-15T00:00:00
db:NVDid:CVE-2021-40346date:2023-11-07T03:38:33.673

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-05867date:2022-01-23T00:00:00
db:VULMONid:CVE-2021-40346date:2021-09-08T00:00:00
db:PACKETSTORMid:165624date:2022-01-20T17:46:33
db:PACKETSTORMid:165533date:2022-01-13T15:57:22
db:PACKETSTORMid:166309date:2022-03-15T15:44:21
db:PACKETSTORMid:166051date:2022-02-18T16:37:39
db:PACKETSTORMid:164940date:2021-11-11T15:02:06
db:PACKETSTORMid:165552date:2022-01-13T16:32:51
db:PACKETSTORMid:169123date:2021-09-28T19:12:00
db:CNNVDid:CNNVD-202109-365date:2021-09-08T00:00:00
db:NVDid:CVE-2021-40346date:2021-09-08T17:15:12.457