Most recent entries from all

ALSA-2022:1915 — Moderate: httpd:2.4 security and bug fix update

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)

* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)

* httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)

* httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-06393

Withdrawn: BELL-CVE-2021-44224 — CVE-2021-44224 does not affect BellSoft software

Withdrawn by the publisher.

BIT-apache-2021-44224 — Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

Affected: Bitnami: apache

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

certfr-2021-avi-972 — De multiples vulnérabilités ont été découvertes dans Apache httpd. Elles permettent à un attaquant de provoquer un déni…

certfr-2021-avi-972

cnvd-2021-102387

EUVD-2026-32880

fkie_cve-2021-44224

GHSA-92ww-hwmg-qq7p

gsd-2021-44224

msrc_CVE-2021-44224 — Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

msrc_CVE-2021-44224

OESA-2021-1473 — httpd security update

Affected: openEuler:20.03-LTS-SP1: httpd, openEuler:20.03-LTS-SP2: httpd

Apache HTTP Server. Security Fix(es): A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).(CVE-2021-44224) A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.(CVE-2021-44790)

openSUSE-SU-2022:0091-1 — Security update for apache2

Security update for apache2

RHSA-2022:6753 — Red Hat Security Advisory: httpd24-httpd security and bug fix update

httpd: Request splitting via HTTP/2 method injection and mod_proxy httpd: NULL pointer dereference via malformed requests httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path httpd: Out-of-bounds write in ap_escape_quotes() via malicious input httpd: possible NULL dereference or SSRF in forward proxy configurations httpd: mod_lua: Use of uninitialized value of in r:parsebody httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody httpd: mod_sed: Read/write beyond bounds httpd: mod_proxy_ajp: Possible request smuggling httpd: Out-of-bounds read via ap_rwrite() httpd: Out-of-bounds read in ap_strcmp_match() httpd: mod_lua: DoS in r:parsebody httpd: mod_sed: DoS vulnerability httpd: mod_lua: Information disclosure with websockets httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

SUSE-SU-2022:0065-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2021-44224

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2

WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.