{
  "threat_severity" : "Moderate",
  "public_date" : "2021-09-08T17:37:00Z",
  "bugzilla" : {
    "description" : "haproxy: request smuggling attack or response splitting via duplicate content-length header",
    "id" : "2000599",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2000599"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-444",
  "details" : [ "An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.", "Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while parsing an HTTP request. The highest threat from this vulnerability is integrity." ],
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 4.6",
    "release_date" : "2022-01-12T00:00:00Z",
    "advisory" : "RHSA-2022:0024",
    "cpe" : "cpe:/a:redhat:openshift:4.6::el7",
    "package" : "haproxy-0:2.0.16-2.el7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.7",
    "release_date" : "2022-01-19T00:00:00Z",
    "advisory" : "RHSA-2022:0114",
    "cpe" : "cpe:/a:redhat:openshift:4.7::el7",
    "package" : "haproxy-0:2.0.19-2.el7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.8",
    "release_date" : "2022-01-05T00:00:00Z",
    "advisory" : "RHSA-2021:5208",
    "cpe" : "cpe:/a:redhat:openshift:4.8::el7",
    "package" : "haproxy-0:2.2.13-2.el7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.9",
    "release_date" : "2021-11-10T00:00:00Z",
    "advisory" : "RHSA-2021:4118",
    "cpe" : "cpe:/a:redhat:openshift:4.9::el8",
    "package" : "haproxy-0:2.2.15-2.el8"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "haproxy",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "haproxy",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "haproxy",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "haproxy",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Out of support scope",
    "package_name" : "haproxy",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat Software Collections",
    "fix_state" : "Not affected",
    "package_name" : "rh-haproxy18-haproxy",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-40346\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-40346\nhttps://www.haproxy.org/download/2.4/src/CHANGELOG" ],
  "name" : "CVE-2021-40346",
  "mitigation" : {
    "value" : "To mitigate this problem the following can be added to proxy config:\nhttp-request deny if { req.hdr_cnt(content-length) gt 1 }\nhttp-response deny if { res.hdr_cnt(content-length) gt 1 }",
    "lang" : "en:us"
  },
  "csaw" : false
}