onyx --cves cve-2021-39241
CVE-2021-39241
- score
- <0.1
- cvss
- 5.3
- epss
- 1.7%
- published
- 2021-08-17
- kev added
- —
- first seen
HAProxy versions before 2.0.24, 2.2.16, 2.3.13, and 2.4.3 contain an issue where an HTTP method name may include a space followed by a protected resource, potentially leading to misinterpretation of requests, exploit requires sending crafted HTTP requests.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
NVD-CWE-noinfo
References 5
- https://www.mail-archive.com/haproxy%40formilux.org/msg41041.html
- https://www.debian.org/security/2021/dsa-4960
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=89265224d314a056d77d974284802c1b8a0dc97f
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ALECUZDIMT5FYGP6V6PVSI4BKVZTZWN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPNY4WZIQUAUOCLIMUPC37AQWNXTWIQM/