Inconsistent interpretation of HTTP requests in HAProxy - CVE-2021-40346

Vulnerability identifier: #VU56401

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-40346

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/2 requests within the htx_add_header() and htx_add_trailer() functions when processing HTTP header name length encoding in the HTX representation. A remote attacker can send a specially crafted HTTP request to the server and smuggle HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

HAProxy
cri-o (Red Hat package)
haproxy (Red Hat package)
haproxy (Debian package)
openshift (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openstack-ironic (Red Hat package)
ostree (Red Hat package)
haproxy (Ubuntu package)
haproxy
haproxy-debuginfo
haproxy-debugsource
haproxy-help
Red Hat OpenShift Container Platform
SUSE Linux Enterprise High Availability
openEuler
Ubuntu
Fedora

Install update from vendor's website.

cri-o (Red Hat package) - addressed in versions 1.20.6-5.rhaos4.7.git8594c20.el7, 1.20.6-5.rhaos4.7.git8594c20.el8, 1.22.0-78.rhaos4.9.gitd745cab.el8, 1.22.0-91.rhaos4.9.gitd745cab.el7
haproxy (Red Hat package) - addressed in versions 2.0.16-2.el7, 2.0.16-4.el8, 2.0.19-2.el7, 2.0.19-2.el8, 2.2.13-2.el7, 2.2.13-2.el8, 2.2.15-2.el8
haproxy (Debian package) - update to 2.2.9-2+deb11u2
Red Hat OpenShift Container Platform - addressed in versions 4.6.53, 4.7.41, 4.8.25, 4.9.6
openshift (Red Hat package) - addressed in versions 4.6.0-202112092023.p0.g845f228.assembly.stream.el7, 4.6.0-202112092023.p0.g845f228.assembly.stream.el8, 4.7.0-202201082234.p0.ge880017.assembly.stream.el7, 4.7.0-202201082234.p0.ge880017.assembly.stream.el8, 4.8.0-202112150047.p0.gb4b4813.assembly.stream.el7, 4.8.0-202112150047.p0.gb4b4813.assembly.stream.el8, 4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el7, 4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8
openshift-kuryr (Red Hat package) - addressed in versions 4.7.0-202201082234.p0.g72de60e.assembly.stream.el8, 4.8.0-202112131630.p0.g839864c.assembly.stream.el8, 4.9.0-202110281423.p0.git.4595a4e.assembly.stream.el8
openshift-ansible (Red Hat package) - update to 4.7.0-202201082234.p0.g4a5273a.assembly.stream.el7
openshift-clients (Red Hat package) - addressed in versions 4.7.0-202201082234.p0.g25914b8.assembly.stream.el7, 4.7.0-202201082234.p0.g25914b8.assembly.stream.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.7.0-202201082234.p0.g39cfc66.assembly.stream.el8
openstack-ironic (Red Hat package) - update to 18.1.1-0.20211019162143.e0437cd.el8
ostree (Red Hat package) - update to 2020.7-6.el8_4
haproxy (Ubuntu package) - addressed in versions 2.0.13-2ubuntu0.3, 2.2.9-1ubuntu0.2
haproxy - addressed in versions 2.0.14-3.31.1, 2.0.14-8.23.1, 2.0.14-11.11.1
haproxy-debuginfo - addressed in versions 2.0.14-3.31.1, 2.0.14-8.23.1, 2.0.14-11.11.1
haproxy-debugsource - addressed in versions 2.0.14-3.31.1, 2.0.14-8.23.1, 2.0.14-11.11.1
haproxy - update to 2.2.16-2
haproxy-debugsource - update to 2.2.16-2
haproxy-debuginfo - update to 2.2.16-2
haproxy-help - update to 2.2.16-2
haproxy - addressed in versions 2.2.17-1.fc33, 2.3.14-1.fc34

• Exploit #6736 - CVE-2021-40346 () (September 12, 2021)
• Exploit #6723 - CVE-2021-40346-POC (CVE-2021-40346 integer overflow enables http smuggling) (September 12, 2021)
• Exploit #6722 - CVE-2021-40346 (CVE-2021-40346 PoC (HAProxy HTTP Smuggling)) (September 12, 2021)

• https://www.mail-archive.com/haproxy@formilux.org/msg41114.html
• https://git.haproxy.org/?p=haproxy.git;a=commit;h=3b69886f7dcc3cfb3d166309018e6cfec9ce2c95

• HTTP request suggling in HAProxy
• Debian update for haproxy
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8
• Red Hat OpenShift Container Platform update for haproxy
• Red Hat OpenShift Container Platform update for Apache Log4j
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• SUSE update for haproxy
• SUSE update for haproxy
• SUSE update for haproxy
• Ubuntu update for haproxy
• openEuler update for haproxy
• Fedora 33 update for haproxy
• Fedora 34 update for haproxy