Most recent entries from all

ALSA-2021:3816 — Important: httpd:2.4 security update

Affected: AlmaLinux:8: mod_http2, AlmaLinux:8: mod_md

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:" (CVE-2021-40438)

* httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-04820

Withdrawn: BELL-CVE-2021-40438 — CVE-2021-40438 does not affect BellSoft software

Withdrawn by the publisher.

BIT-apache-2021-40438 — mod_proxy SSRF

Affected: Bitnami: apache

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

certfr-2021-avi-713 — De multiples vulnérabilités ont été découvertes dans Apache httpd. Elles permettent à un attaquant de provoquer un prob…

certfr-2021-avi-713

cnvd-2022-03224

EUVD-2026-348794

fkie_cve-2021-40438

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

GHSA-rwxq-58vm-3v2j

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

gsd-2021-40438

ICSA-22-167-06 — Siemens Apache HTTP Server

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

msrc_CVE-2021-40438 — mod_proxy SSRF

msrc_CVE-2021-40438

OESA-2021-1369 — httpd security update

Affected: openEuler:20.03-LTS-SP1: httpd, openEuler:20.03-LTS-SP2: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).(CVE-2021-36160) Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.(CVE-2021-34798) A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.(CVE-2021-40438)

openSUSE-SU-2021:1438-1 — Security update for apache2

Security update for apache2

RHSA-2021:3745 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP9 security update

httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:"

SUSE-SU-2021:3299-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2021-40438

Affected: Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

WID-SEC-W-2022-0724 — Apache HTTP Server: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial of Service Zustand herzustellen.