Most recent entries from all

ALSA-2022:1915 — Moderate: httpd:2.4 security and bug fix update

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)

* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)

* httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)

* httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-04216

Withdrawn: BELL-CVE-2021-33193 — CVE-2021-33193 does not affect BellSoft software

Withdrawn by the publisher.

BIT-apache-2021-33193 — Request splitting via HTTP/2 method injection and mod_proxy

Affected: Bitnami: apache

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

certfr-2021-avi-713 — De multiples vulnérabilités ont été découvertes dans Apache httpd. Elles permettent à un attaquant de provoquer un prob…

certfr-2021-avi-713

EUVD-2026-28298

fkie_cve-2021-33193

GHSA-p9fg-6rr5-38xc

gsd-2021-33193

msrc_CVE-2021-33193 — Request splitting via HTTP/2 method injection and mod_proxy

msrc_CVE-2021-33193

openSUSE-SU-2021:1234-1 — Security update for apache2

Security update for apache2

RHSA-2022:6753 — Red Hat Security Advisory: httpd24-httpd security and bug fix update

httpd: Request splitting via HTTP/2 method injection and mod_proxy httpd: NULL pointer dereference via malformed requests httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path httpd: Out-of-bounds write in ap_escape_quotes() via malicious input httpd: possible NULL dereference or SSRF in forward proxy configurations httpd: mod_lua: Use of uninitialized value of in r:parsebody httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody httpd: mod_sed: Read/write beyond bounds httpd: mod_proxy_ajp: Possible request smuggling httpd: Out-of-bounds read via ap_rwrite() httpd: Out-of-bounds read in ap_strcmp_match() httpd: mod_lua: DoS in r:parsebody httpd: mod_sed: DoS vulnerability httpd: mod_lua: Information disclosure with websockets httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

SUSE-SU-2021:2918-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2021-33193

Affected: Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2

WID-SEC-W-2022-0722 — Apache HTTP Server: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen.