RHSA-2021:4118MediumCVSS 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.9.6 packages and security update

Published
November 10, 2021
Last Modified
November 6, 2026

🔗 CVE IDs covered (4)

CVE-2021-39240 →CVE-2021-39241 →CVE-2021-39242 →CVE-2021-40346 →

📋 Description

CVE-2021-39240 — haproxy: does not ensure that the scheme and path portions of a URI have the expected characters CVE-2021-39241 — haproxy: an HTTP method name may contain a space followed by the name of a protected resource CVE-2021-39242 — haproxy: it can lead to a situation with an attacker-controlled HTTP Host header because a mismatch between Host and authority is mishandled CVE-2021-40346 — haproxy: request smuggling attack or response splitting via duplicate content-length header

🎯 Affected products39

  • Red Hat OpenShift Container Platform 4.9
  • cri-o-0:1.22.0-78.rhaos4.9.gitd745cab.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-0:1.22.0-78.rhaos4.9.gitd745cab.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-0:1.22.0-78.rhaos4.9.gitd745cab.el8.s390x as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-0:1.22.0-78.rhaos4.9.gitd745cab.el8.src as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-0:1.22.0-78.rhaos4.9.gitd745cab.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-0:1.22.0-91.rhaos4.9.gitd745cab.el7.src as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-0:1.22.0-91.rhaos4.9.gitd745cab.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-debuginfo-0:1.22.0-78.rhaos4.9.gitd745cab.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-debuginfo-0:1.22.0-78.rhaos4.9.gitd745cab.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-debuginfo-0:1.22.0-78.rhaos4.9.gitd745cab.el8.s390x as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-debuginfo-0:1.22.0-78.rhaos4.9.gitd745cab.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-debuginfo-0:1.22.0-91.rhaos4.9.gitd745cab.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-debugsource-0:1.22.0-78.rhaos4.9.gitd745cab.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-debugsource-0:1.22.0-78.rhaos4.9.gitd745cab.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-debugsource-0:1.22.0-78.rhaos4.9.gitd745cab.el8.s390x as a component of Red Hat OpenShift Container Platform 4.9
  • cri-o-debugsource-0:1.22.0-78.rhaos4.9.gitd745cab.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.9
  • haproxy-0:2.2.15-2.el8.src as a component of Red Hat OpenShift Container Platform 4.9
  • haproxy-debugsource-0:2.2.15-2.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.9
  • haproxy-debugsource-0:2.2.15-2.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.9
  • haproxy-debugsource-0:2.2.15-2.el8.s390x as a component of Red Hat OpenShift Container Platform 4.9
  • haproxy-debugsource-0:2.2.15-2.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift-0:4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el7.src as a component of Red Hat OpenShift Container Platform 4.9
  • openshift-0:4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.src as a component of Red Hat OpenShift Container Platform 4.9
  • openshift-hyperkube-0:4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift-hyperkube-0:4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.aarch64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift-hyperkube-0:4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.9
  • openshift-hyperkube-0:4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.s390x as a component of Red Hat OpenShift Container Platform 4.9
  • openshift-hyperkube-0:4.9.0-202111020225.p0.git.d8c4430.assembly.stream.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.9
  • openshift-kuryr-0:4.9.0-202110281423.p0.git.4595a4e.assembly.stream.el8.src as a component of Red Hat OpenShift Container Platform 4.9
  • +9 more not shown

✅ Remediation

For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html Workaround: To mitigate this problem the following can be added to proxy config: http-request deny if { req.hdr_cnt(content-length) gt 1 } http-response deny if { res.hdr_cnt(content-length) gt 1 }

🔗 References (7)