Bug 2000599 (CVE-2021-40346) - CVE-2021-40346 haproxy: request smuggling attack or response splitting via duplicate content-length header
Summary: CVE-2021-40346 haproxy: request smuggling attack or response splitting via du...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-40346
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2000621 2001963 2002411 2002412 2002703 2002706 2002708 2002753 2003162 2003180 2019913
Blocks: 1999861
TreeView+ depends on / blocked
 
Reported: 2021-09-02 13:20 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-09-25 06:19 UTC (History)
18 users (show)

Fixed In Version: haproxy 2.4.4
Doc Type: If docs needed, set a value
Doc Text:
Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while parsing an HTTP request. The highest threat from this vulnerability is integrity.
Clone Of:
Environment:
Last Closed: 2021-11-10 20:57:21 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4118 0 None None None 2021-11-10 20:49:40 UTC
Red Hat Product Errata RHSA-2021:5208 0 None None None 2022-01-05 15:44:22 UTC
Red Hat Product Errata RHSA-2022:0024 0 None None None 2022-01-12 08:46:22 UTC
Red Hat Product Errata RHSA-2022:0114 0 None None None 2022-01-19 13:26:35 UTC

Description Guilherme de Almeida Suckevicz 2021-09-02 13:20:50 UTC 
A flaw was found in haproxy in versions 2.0 and later. A weakness in the HTX code allows it to bypass the check for duplicate content-length header and inject a second fake one leading to request smuggling attack or possibly a response splitting one.
Comment 3 devthomp 2021-09-08 18:09:07 UTC 
Created haproxy tracking bugs for this issue:

Affects: fedora-all [bug 2002411]
Comment 5 devthomp 2021-09-08 18:15:10 UTC 
haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by HAProxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in HAProxy while parsing an HTTP request. 

RHEL7 and RHEL8 are not affected by flaw:
However to mitigate this problem the following can be added to proxy config:

http-request deny if { req.hdr_cnt(content-length) gt 1 }
http-response deny if { res.hdr_cnt(content-length) gt 1 }
Comment 6 devthomp 2021-09-08 19:45:26 UTC 
Patch for issue:

https://git.haproxy.org/?p=haproxy-2.4.git;a=blobdiff;f=include/haproxy/htx.h;h=a6535237b18ce78d01ef4ca88618082b3ba45853;hp=b6d95274e9d35e729850502b4883c65aabbeef9f;hb=1fd2566683f6fb66b180ce9c3d9062ddaa81d6d7;hpb=86cb2cd3c68a0f3072a326def89449e10760423d
Comment 7 msiddiqu 2021-09-09 11:14:03 UTC 
References: 
 
https://thehackernews.com/2021/09/haproxy-found-vulnerable-to-critical.html
Comment 10 errata-xmlrpc 2021-11-10 20:49:39 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.9

Via RHSA-2021:4118 https://access.redhat.com/errata/RHSA-2021:4118
Comment 11 Product Security DevOps Team 2021-11-10 20:57:18 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-40346
Comment 12 errata-xmlrpc 2022-01-05 15:44:19 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:5208 https://access.redhat.com/errata/RHSA-2021:5208
Comment 13 errata-xmlrpc 2022-01-12 08:46:19 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2022:0024 https://access.redhat.com/errata/RHSA-2022:0024
Comment 14 errata-xmlrpc 2022-01-19 13:26:33 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.7

Via RHSA-2022:0114 https://access.redhat.com/errata/RHSA-2022:0114
Note You need to log in before you can comment on or make changes to this bug.