Most recent entries from all

ALSA-2021:4257 — Moderate: httpd:2.4 security, bug fix, and enhancement update

Affected: AlmaLinux:8: mod_http2, AlmaLinux:8: mod_md

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: mod_session: NULL pointer dereference when parsing Cookie header (CVE-2021-26690)

* httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-03681

Withdrawn: BELL-CVE-2021-26690 — CVE-2021-26690 does not affect BellSoft software

Withdrawn by the publisher.

BIT-apache-2021-26690 — mod_session NULL pointer dereference

Affected: Bitnami: apache

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

certfr-2021-avi-875 — De multiples vulnérabilités ont été découvertes dans les produits Check Point. Certaines d'entre elles permettent à un…

certfr-2021-avi-875

cnvd-2022-13199

EUVD-2026-25131

fkie_cve-2021-26690

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

GHSA-f669-j28w-pjvg

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

gsd-2021-26690

msrc_CVE-2021-26690 — mod_session NULL pointer dereference

msrc_CVE-2021-26690

OESA-2021-1253 — httpd security update

Affected: openEuler:20.03-LTS-SP1: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service(CVE-2021-26690)

openSUSE-SU-2021:0908-1 — Security update for apache2

Security update for apache2

RHSA-2021:4613 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update

httpd: mod_proxy_wstunnel tunneling of non Upgraded connection pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 httpd: mod_proxy NULL pointer dereference pcre: Integer overflow when parsing callout numeric arguments httpd: Single zero byte stack overflow in mod_auth_digest JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure openssl: Read buffer overruns processing ASN.1 strings openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash() httpd: mod_session: NULL pointer dereference when parsing Cookie header httpd: mod_session: Heap overflow via a crafted SessionHeader value httpd: Unexpected URL matching with 'MergeSlashes OFF' httpd: NULL pointer dereference via malformed requests

SUSE-SU-2021:2004-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2021-26690

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

WID-SEC-W-2022-0438 — Apache HTTP Server: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder sonstige Auswirkungen zu verursachen.