In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS…

{
                    "defaultStatus": "unaffected",
                    "packageName": "dataplaneapi",
                    "product": "Data Plane API EE",
                    "vendor": "HAProxy",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "2.9.29-ee1",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "2.9.28-ee1",
                            "status": "affected",
                            "version": "2.2.0-ee1",
                            "versionType": "custom"
                        },
                        {
                            "changes": [
                                {
                                    "at": "3.0.25-ee1",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "3.0.24-ee1",
                            "status": "affected",
                            "version": "3.0-ee",
                            "versionType": "custom"
                        },
                        {
                            "changes": [
                                {
                                    "at": "3.2.17-ee1",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "3.2.16-ee1",
                            "status": "affected",
                            "version": "3.1-ee",
                            "versionType": "custom"
                        },
                        {
                            "changes": [
                                {
                                    "at": "3.3.9-ee1",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "3.3.8-ee1",
                            "status": "affected",
                            "version": "3.3-ee",
                            "versionType": "custom"
                        },
                        {
                            "changes": [
                                {
                                    "at": "3.4.4-ee1",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "3.4.3-ee2",
                            "status": "affected",
                            "version": "3.4-ee",
                            "versionType": "custom"
                        }
                    ]
                }

{
                    "defaultStatus": "unaffected",
                    "packageName": "dataplaneapi-ee",
                    "product": "Data Plane API CE",
                    "repo": "https://github.com/haproxytech/dataplaneapi",
                    "vendor": "HAProxy",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "2.9.29",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "2.9.28",
                            "status": "affected",
                            "version": "2.2.0",
                            "versionType": "custom"
                        },
                        {
                            "changes": [
                                {
                                    "at": "3.0.25",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "3.0.24",
                            "status": "affected",
                            "version": "3.0.0",
                            "versionType": "custom"
                        },
                        {
                            "changes": [
                                {
                                    "at": "3.2.17",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "3.2.16",
                            "status": "affected",
                            "version": "3.1.0",
                            "versionType": "custom"
                        },
                        {
                            "changes": [
                                {
                                    "at": "3.3.9",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "3.3.8",
                            "status": "affected",
                            "version": "3.3.0",
                            "versionType": "custom"
                        },
                        {
                            "changes": [
                                {
                                    "at": "3.4.4",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThanOrEqual": "3.4.3",
                            "status": "affected",
                            "version": "3.4.0",
                            "versionType": "custom"
                        }
                    ]
                }