USN-5063-1: HAProxy vulnerabilities

Ori Hollander discovered that HAProxy incorrectly handled HTTP header name length encoding. A remote attacker could possibly use this issue to inject a duplicate content-length header and perform request smuggling attacks...

USN-5063-1 haproxy vulnerabilities

Ori Hollander discovered that HAProxy incorrectly handled HTTP header name length encoding. A remote attacker could possibly use this issue to inject a duplicate content-length header and perform request smuggling attacks...

Ubuntu 20.04 LTS : HAProxy vulnerabilities (USN-5063-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5063-1 advisory. Ori Hollander discovered that HAProxy incorrectly handled HTTP header name length encoding. A remote attacker could possibly use this issue to inject a duplicate...

openSUSE: Security Advisory for haproxy (openSUSE-SU-2021:2975-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Medium: tomcat8

Issue Overview: Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly...

Haproxy HAProxy 输入验证错误漏洞

HAProxy is an open source TCP/HTTP load balancing server from the French company HAProxy=. =HAProxy suffers from an input validation error vulnerability, which stems from a lack of header name length checking in the htxaddheader and htxaddtrailer functions in HAProxy, and can be exploited by an...

openSUSE 15 Security Update : haproxy (openSUSE-SU-2021:2975-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:2975-1 advisory. - An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing ...

SUSE SLES15 Security Update : haproxy (SUSE-SU-2021:2975-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:2975-1 advisory. - CVE-2021-40346: Fixed request smuggling vulnerability in HTX bsc1189877. Tenable has extracted the preceding description block directly from the SUSE...

[SECURITY] [DSA 4968-1] haproxy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4968-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 07, 2021 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4968-1] haproxy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4968-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 07, 2021 https://www.debian.org/security/faq -...

OPENSUSE-SU-2021:2975-1 Security update for haproxy

This update for haproxy fixes the following issues: - CVE-2021-40346: Fixed request smuggling vulnerability in HTX bsc1189877...

SUSE-SU-2021:2975-1 Security update for haproxy

This update for haproxy fixes the following issues: - CVE-2021-40346: Fixed request smuggling vulnerability in HTX bsc1189877...

UBUNTU-CVE-2021-40346

An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs...

CVE-2021-40346

An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs...

Security update for haproxy (moderate)

openSUSE Security Update: Security update for haproxy Announcement ID: openSUSE-SU-2021:2975-1 Rating: moderate References: 1189877 Cross-References: CVE-2021-40346 CVSS scores: CVE-2021-40346 SUSE: 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 An update...

Security Bulletin: CVE-2021-33037 Apache Tomcat 8.5.66 did not correctly parse the HTTP transfer-encoding request header leading to the possibility to request smuggling when used with a reverse proxy

Summary Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the...

PT-2021-6117

Name of the Vulnerable Software and Affected Versions D-Link DIR-X1860 versions prior to v1.10WWB09 Beta Description The issue is related to a web application vulnerability in the D-Link DIR-X1860 Wi-Fi router's firmware, specifically concerning inadequate handling of HTTP requests. This can be...

GHSA-8928-2FGM-6X9X HTTP Request Smuggling in actix-http

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling HRS attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also...

HTTP Request Smuggling in actix-http

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling HRS attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also...

a2 (>=0.5.0-alpha.6, <=0.5.0-alpha.7), anitable (0.1.0) +66 more potentially affected by CVE-2021-21299 via hyper (>=0.13.0-alpha.1, <=0.13.7)

hyper CARGO version =0.13.0-alpha.1, =0.5.0-alpha.6, =0.1.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.30.0, =0.31.1 and more Source cves: CVE-2021-21299 Source advisory: OSV:GHSA-6HFQ-H8HQ-87MF...