The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4118 advisory.

  - haproxy: does not ensure that the scheme and path portions of a URI have the expected characters     (CVE-2021-39240)

  - haproxy: an HTTP method name may contain a space followed by the name of a protected resource     (CVE-2021-39241)

  - haproxy: it can lead to a situation with an attacker-controlled HTTP Host header because a mismatch     between Host and authority is mishandled (CVE-2021-39242)

  - haproxy: request smuggling attack or response splitting via duplicate content-length header     (CVE-2021-40346)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4960 advisory.

  - An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not     ensure that the scheme and path portions of a URI have the expected characters. For example, the authority     field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to     achieve. (CVE-2021-39240)

  - An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before     2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is     possible that a server would interpret this as a request for that protected resource, such as in the GET     /admin? HTTP/1.1 /static/images HTTP/1.1 example. (CVE-2021-39241)

  - An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead     to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority     is mishandled. (CVE-2021-39242)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the haproxy package has been released.

The version of haproxy2 installed on the remote host is prior to 2.2.17-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2HAPROXY2-2023-005 advisory.

  - An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not     ensure that the scheme and path portions of a URI have the expected characters. For example, the authority     field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to     achieve. (CVE-2021-39240)

  - An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before     2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is     possible that a server would interpret this as a request for that protected resource, such as in the GET     /admin? HTTP/1.1 /static/images HTTP/1.1 example. (CVE-2021-39241)

  - An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead     to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority     is mishandled. (CVE-2021-39242)

  - An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform     an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs     and possibly other ACLs. (CVE-2021-40346)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the haproxy-2.4.7-1.el9 build changelog.

  - An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not     ensure that the scheme and path portions of a URI have the expected characters. For example, the authority     field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to     achieve. (CVE-2021-39240)

  - An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before     2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is     possible that a server would interpret this as a request for that protected resource, such as in the GET     /admin? HTTP/1.1 /static/images HTTP/1.1 example. (CVE-2021-39241)

  - An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead     to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority     is mishandled. (CVE-2021-39242)

  - An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform     an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs     and possibly other ACLs. (CVE-2021-40346)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
155292	RHEL 7 / 8 : OpenShift Container Platform 4.9.6 packages and (RHSA-2021:4118)	Nessus	Red Hat Local Security Checks	11/12/2021	11/23/2023	high
152638	Debian DSA-4960-1 : haproxy - security update	Nessus	Debian Local Security Checks	8/18/2021	1/20/2022	high
153033	Photon OS 3.0: Haproxy PHSA-2021-3.0-0293	Nessus	PhotonOS Local Security Checks	9/7/2021	7/24/2024	high
153037	Photon OS 4.0: Haproxy PHSA-2021-4.0-0092	Nessus	PhotonOS Local Security Checks	9/7/2021	7/24/2024	high
181935	Amazon Linux 2 : haproxy2 (ALASHAPROXY2-2023-005)	Nessus	Amazon Linux Local Security Checks	9/27/2023	9/28/2023	high
191145	CentOS 9 : haproxy-2.4.7-1.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high