csaf_opensuse - opensuse-su-2021:3522-1

Vulnerability from csaf_opensuse

Published

2021-10-26 13:40

Modified

2021-10-26 13:40

Summary

Security update for apache2

Notes

Title of the patch

Security update for apache2

Description of the patch

This update for apache2 fixes the following issues: - CVE-2021-40438: Fixed a SRF via a crafted request uri-path. (bsc#1190703) - CVE-2021-36160: Fixed an out-of-bounds read via a crafted request uri-path. (bsc#1190702) - CVE-2021-39275: Fixed an out-of-bounds write in ap_escape_quotes() via malicious input. (bsc#1190666) - CVE-2021-34798: Fixed a NULL pointer dereference via malformed requests. (bsc#1190669)

Patchnames

openSUSE-SLE-15.3-2021-3522

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for apache2",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for apache2 fixes the following issues:\n\n- CVE-2021-40438: Fixed a SRF via a crafted request uri-path. (bsc#1190703)\n- CVE-2021-36160: Fixed an out-of-bounds read via a crafted request uri-path. (bsc#1190702)\n- CVE-2021-39275: Fixed an out-of-bounds write in ap_escape_quotes() via malicious input. (bsc#1190666)\n- CVE-2021-34798: Fixed a NULL pointer dereference via malformed requests. (bsc#1190669)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-SLE-15.3-2021-3522",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_3522-1.json",
         },
         {
            category: "self",
            summary: "URL for openSUSE-SU-2021:3522-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JKKOECDBM5767TKS4AX32R26YLJDYTJT/",
         },
         {
            category: "self",
            summary: "E-Mail link for openSUSE-SU-2021:3522-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JKKOECDBM5767TKS4AX32R26YLJDYTJT/",
         },
         {
            category: "self",
            summary: "SUSE Bug 1190666",
            url: "https://bugzilla.suse.com/1190666",
         },
         {
            category: "self",
            summary: "SUSE Bug 1190669",
            url: "https://bugzilla.suse.com/1190669",
         },
         {
            category: "self",
            summary: "SUSE Bug 1190702",
            url: "https://bugzilla.suse.com/1190702",
         },
         {
            category: "self",
            summary: "SUSE Bug 1190703",
            url: "https://bugzilla.suse.com/1190703",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-34798 page",
            url: "https://www.suse.com/security/cve/CVE-2021-34798/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-36160 page",
            url: "https://www.suse.com/security/cve/CVE-2021-36160/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-39275 page",
            url: "https://www.suse.com/security/cve/CVE-2021-39275/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-40438 page",
            url: "https://www.suse.com/security/cve/CVE-2021-40438/",
         },
      ],
      title: "Security update for apache2",
      tracking: {
         current_release_date: "2021-10-26T13:40:11Z",
         generator: {
            date: "2021-10-26T13:40:11Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2021:3522-1",
         initial_release_date: "2021-10-26T13:40:11Z",
         revision_history: [
            {
               date: "2021-10-26T13:40:11Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.43-3.32.1.aarch64",
                        product: {
                           name: "apache2-2.4.43-3.32.1.aarch64",
                           product_id: "apache2-2.4.43-3.32.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.43-3.32.1.aarch64",
                        product: {
                           name: "apache2-devel-2.4.43-3.32.1.aarch64",
                           product_id: "apache2-devel-2.4.43-3.32.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.43-3.32.1.aarch64",
                        product: {
                           name: "apache2-event-2.4.43-3.32.1.aarch64",
                           product_id: "apache2-event-2.4.43-3.32.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.43-3.32.1.aarch64",
                        product: {
                           name: "apache2-example-pages-2.4.43-3.32.1.aarch64",
                           product_id: "apache2-example-pages-2.4.43-3.32.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.43-3.32.1.aarch64",
                        product: {
                           name: "apache2-prefork-2.4.43-3.32.1.aarch64",
                           product_id: "apache2-prefork-2.4.43-3.32.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.43-3.32.1.aarch64",
                        product: {
                           name: "apache2-utils-2.4.43-3.32.1.aarch64",
                           product_id: "apache2-utils-2.4.43-3.32.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.43-3.32.1.aarch64",
                        product: {
                           name: "apache2-worker-2.4.43-3.32.1.aarch64",
                           product_id: "apache2-worker-2.4.43-3.32.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-doc-2.4.43-3.32.1.noarch",
                        product: {
                           name: "apache2-doc-2.4.43-3.32.1.noarch",
                           product_id: "apache2-doc-2.4.43-3.32.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.43-3.32.1.ppc64le",
                        product: {
                           name: "apache2-2.4.43-3.32.1.ppc64le",
                           product_id: "apache2-2.4.43-3.32.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.43-3.32.1.ppc64le",
                        product: {
                           name: "apache2-devel-2.4.43-3.32.1.ppc64le",
                           product_id: "apache2-devel-2.4.43-3.32.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.43-3.32.1.ppc64le",
                        product: {
                           name: "apache2-event-2.4.43-3.32.1.ppc64le",
                           product_id: "apache2-event-2.4.43-3.32.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.43-3.32.1.ppc64le",
                        product: {
                           name: "apache2-example-pages-2.4.43-3.32.1.ppc64le",
                           product_id: "apache2-example-pages-2.4.43-3.32.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.43-3.32.1.ppc64le",
                        product: {
                           name: "apache2-prefork-2.4.43-3.32.1.ppc64le",
                           product_id: "apache2-prefork-2.4.43-3.32.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.43-3.32.1.ppc64le",
                        product: {
                           name: "apache2-utils-2.4.43-3.32.1.ppc64le",
                           product_id: "apache2-utils-2.4.43-3.32.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.43-3.32.1.ppc64le",
                        product: {
                           name: "apache2-worker-2.4.43-3.32.1.ppc64le",
                           product_id: "apache2-worker-2.4.43-3.32.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.43-3.32.1.s390x",
                        product: {
                           name: "apache2-2.4.43-3.32.1.s390x",
                           product_id: "apache2-2.4.43-3.32.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.43-3.32.1.s390x",
                        product: {
                           name: "apache2-devel-2.4.43-3.32.1.s390x",
                           product_id: "apache2-devel-2.4.43-3.32.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.43-3.32.1.s390x",
                        product: {
                           name: "apache2-event-2.4.43-3.32.1.s390x",
                           product_id: "apache2-event-2.4.43-3.32.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.43-3.32.1.s390x",
                        product: {
                           name: "apache2-example-pages-2.4.43-3.32.1.s390x",
                           product_id: "apache2-example-pages-2.4.43-3.32.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.43-3.32.1.s390x",
                        product: {
                           name: "apache2-prefork-2.4.43-3.32.1.s390x",
                           product_id: "apache2-prefork-2.4.43-3.32.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.43-3.32.1.s390x",
                        product: {
                           name: "apache2-utils-2.4.43-3.32.1.s390x",
                           product_id: "apache2-utils-2.4.43-3.32.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.43-3.32.1.s390x",
                        product: {
                           name: "apache2-worker-2.4.43-3.32.1.s390x",
                           product_id: "apache2-worker-2.4.43-3.32.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.43-3.32.1.x86_64",
                        product: {
                           name: "apache2-2.4.43-3.32.1.x86_64",
                           product_id: "apache2-2.4.43-3.32.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.43-3.32.1.x86_64",
                        product: {
                           name: "apache2-devel-2.4.43-3.32.1.x86_64",
                           product_id: "apache2-devel-2.4.43-3.32.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.43-3.32.1.x86_64",
                        product: {
                           name: "apache2-event-2.4.43-3.32.1.x86_64",
                           product_id: "apache2-event-2.4.43-3.32.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.43-3.32.1.x86_64",
                        product: {
                           name: "apache2-example-pages-2.4.43-3.32.1.x86_64",
                           product_id: "apache2-example-pages-2.4.43-3.32.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.43-3.32.1.x86_64",
                        product: {
                           name: "apache2-prefork-2.4.43-3.32.1.x86_64",
                           product_id: "apache2-prefork-2.4.43-3.32.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.43-3.32.1.x86_64",
                        product: {
                           name: "apache2-utils-2.4.43-3.32.1.x86_64",
                           product_id: "apache2-utils-2.4.43-3.32.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.43-3.32.1.x86_64",
                        product: {
                           name: "apache2-worker-2.4.43-3.32.1.x86_64",
                           product_id: "apache2-worker-2.4.43-3.32.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.3",
                        product: {
                           name: "openSUSE Leap 15.3",
                           product_id: "openSUSE Leap 15.3",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-2.4.43-3.32.1.aarch64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
            },
            product_reference: "apache2-2.4.43-3.32.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-2.4.43-3.32.1.ppc64le as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
            },
            product_reference: "apache2-2.4.43-3.32.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-2.4.43-3.32.1.s390x as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
            },
            product_reference: "apache2-2.4.43-3.32.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-2.4.43-3.32.1.x86_64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
            },
            product_reference: "apache2-2.4.43-3.32.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-devel-2.4.43-3.32.1.aarch64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
            },
            product_reference: "apache2-devel-2.4.43-3.32.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-devel-2.4.43-3.32.1.ppc64le as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
            },
            product_reference: "apache2-devel-2.4.43-3.32.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-devel-2.4.43-3.32.1.s390x as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
            },
            product_reference: "apache2-devel-2.4.43-3.32.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-devel-2.4.43-3.32.1.x86_64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
            },
            product_reference: "apache2-devel-2.4.43-3.32.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-doc-2.4.43-3.32.1.noarch as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
            },
            product_reference: "apache2-doc-2.4.43-3.32.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-event-2.4.43-3.32.1.aarch64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
            },
            product_reference: "apache2-event-2.4.43-3.32.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-event-2.4.43-3.32.1.ppc64le as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
            },
            product_reference: "apache2-event-2.4.43-3.32.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-event-2.4.43-3.32.1.s390x as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
            },
            product_reference: "apache2-event-2.4.43-3.32.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-event-2.4.43-3.32.1.x86_64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
            },
            product_reference: "apache2-event-2.4.43-3.32.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-example-pages-2.4.43-3.32.1.aarch64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
            },
            product_reference: "apache2-example-pages-2.4.43-3.32.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-example-pages-2.4.43-3.32.1.ppc64le as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
            },
            product_reference: "apache2-example-pages-2.4.43-3.32.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-example-pages-2.4.43-3.32.1.s390x as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
            },
            product_reference: "apache2-example-pages-2.4.43-3.32.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-example-pages-2.4.43-3.32.1.x86_64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
            },
            product_reference: "apache2-example-pages-2.4.43-3.32.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-prefork-2.4.43-3.32.1.aarch64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
            },
            product_reference: "apache2-prefork-2.4.43-3.32.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-prefork-2.4.43-3.32.1.ppc64le as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
            },
            product_reference: "apache2-prefork-2.4.43-3.32.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-prefork-2.4.43-3.32.1.s390x as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
            },
            product_reference: "apache2-prefork-2.4.43-3.32.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-prefork-2.4.43-3.32.1.x86_64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
            },
            product_reference: "apache2-prefork-2.4.43-3.32.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-utils-2.4.43-3.32.1.aarch64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
            },
            product_reference: "apache2-utils-2.4.43-3.32.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-utils-2.4.43-3.32.1.ppc64le as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
            },
            product_reference: "apache2-utils-2.4.43-3.32.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-utils-2.4.43-3.32.1.s390x as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
            },
            product_reference: "apache2-utils-2.4.43-3.32.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-utils-2.4.43-3.32.1.x86_64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
            },
            product_reference: "apache2-utils-2.4.43-3.32.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-worker-2.4.43-3.32.1.aarch64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
            },
            product_reference: "apache2-worker-2.4.43-3.32.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-worker-2.4.43-3.32.1.ppc64le as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
            },
            product_reference: "apache2-worker-2.4.43-3.32.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-worker-2.4.43-3.32.1.s390x as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
            },
            product_reference: "apache2-worker-2.4.43-3.32.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-worker-2.4.43-3.32.1.x86_64 as component of openSUSE Leap 15.3",
               product_id: "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
            },
            product_reference: "apache2-worker-2.4.43-3.32.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.3",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2021-34798",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-34798",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-34798",
               url: "https://www.suse.com/security/cve/CVE-2021-34798",
            },
            {
               category: "external",
               summary: "SUSE Bug 1190669 for CVE-2021-34798",
               url: "https://bugzilla.suse.com/1190669",
            },
            {
               category: "external",
               summary: "SUSE Bug 1191297 for CVE-2021-34798",
               url: "https://bugzilla.suse.com/1191297",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2021-10-26T13:40:11Z",
               details: "important",
            },
         ],
         title: "CVE-2021-34798",
      },
      {
         cve: "CVE-2021-36160",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-36160",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-36160",
               url: "https://www.suse.com/security/cve/CVE-2021-36160",
            },
            {
               category: "external",
               summary: "SUSE Bug 1190702 for CVE-2021-36160",
               url: "https://bugzilla.suse.com/1190702",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2021-10-26T13:40:11Z",
               details: "important",
            },
         ],
         title: "CVE-2021-36160",
      },
      {
         cve: "CVE-2021-39275",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-39275",
            },
         ],
         notes: [
            {
               category: "general",
               text: "ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-39275",
               url: "https://www.suse.com/security/cve/CVE-2021-39275",
            },
            {
               category: "external",
               summary: "SUSE Bug 1190666 for CVE-2021-39275",
               url: "https://bugzilla.suse.com/1190666",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2021-10-26T13:40:11Z",
               details: "important",
            },
         ],
         title: "CVE-2021-39275",
      },
      {
         cve: "CVE-2021-40438",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-40438",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
               "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-40438",
               url: "https://www.suse.com/security/cve/CVE-2021-40438",
            },
            {
               category: "external",
               summary: "SUSE Bug 1190703 for CVE-2021-40438",
               url: "https://bugzilla.suse.com/1190703",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-devel-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-doc-2.4.43-3.32.1.noarch",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-event-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-example-pages-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-prefork-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-utils-2.4.43-3.32.1.x86_64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.aarch64",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.ppc64le",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.s390x",
                  "openSUSE Leap 15.3:apache2-worker-2.4.43-3.32.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2021-10-26T13:40:11Z",
               details: "important",
            },
         ],
         title: "CVE-2021-40438",
      },
   ],
}

cve-2021-40438

Vulnerability from cvelistv5

Published

2021-09-16 14:40

Modified

2025-02-06 21:09

Severity ?

Summary

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

References

▼	URL	Tags
	https://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2021/dsa-4982	vendor-advisory, x_refsource_DEBIAN
	https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ	vendor-advisory, x_refsource_CISCO
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://www.tenable.com/security/tns-2021-17	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20211008-0004/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202208-20	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: Apache HTTP Server 2.4 <

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T02:44:10.131Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://httpd.apache.org/security/vulnerabilities_24.html",
               },
               {
                  name: "FEDORA-2021-dce7e7738e",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
               },
               {
                  name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "FEDORA-2021-e3f6dd670d",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
               },
               {
                  name: "[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
               },
               {
                  name: "[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E",
               },
               {
                  name: "DSA-4982",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4982",
               },
               {
                  name: "[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_CISCO",
                     "x_transferred",
                  ],
                  url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2021-17",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
               },
               {
                  name: "GLSA-202208-20",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202208-20",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "HIGH",
                     attackVector: "NETWORK",
                     availabilityImpact: "HIGH",
                     baseScore: 9,
                     baseSeverity: "CRITICAL",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "HIGH",
                     privilegesRequired: "NONE",
                     scope: "CHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2021-40438",
                        options: [
                           {
                              Exploitation: "active",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-06T21:08:29.032806Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
               {
                  other: {
                     content: {
                        dateAdded: "2021-12-01",
                        reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40438",
                     },
                     type: "kev",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-06T21:09:00.866Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache HTTP Server",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     lessThanOrEqual: "2.4.48",
                     status: "affected",
                     version: "Apache HTTP Server 2.4",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "The issue was discovered by the Apache HTTP security team while analysing CVE-2021-36160",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     other: "high",
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-918",
                     description: "CWE-918 Server Side Request Forgery (SSRF)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-08-14T01:07:57.000Z",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://httpd.apache.org/security/vulnerabilities_24.html",
            },
            {
               name: "FEDORA-2021-dce7e7738e",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
            },
            {
               name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "FEDORA-2021-e3f6dd670d",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
            },
            {
               name: "[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
            },
            {
               name: "[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E",
            },
            {
               name: "DSA-4982",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-4982",
            },
            {
               name: "[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
               tags: [
                  "vendor-advisory",
                  "x_refsource_CISCO",
               ],
               url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.tenable.com/security/tns-2021-17",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
            },
            {
               name: "GLSA-202208-20",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202208-20",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         timeline: [
            {
               lang: "en",
               time: "2021-09-16T00:00:00",
               value: "2.4.49 released",
            },
         ],
         title: "mod_proxy SSRF",
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2021-40438",
               STATE: "PUBLIC",
               TITLE: "mod_proxy SSRF",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache HTTP Server",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<=",
                                          version_name: "Apache HTTP Server 2.4",
                                          version_value: "2.4.48",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache Software Foundation",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "The issue was discovered by the Apache HTTP security team while analysing CVE-2021-36160",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.",
                  },
               ],
            },
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: [
               {
                  other: "high",
               },
            ],
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-918 Server Side Request Forgery (SSRF)",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://httpd.apache.org/security/vulnerabilities_24.html",
                     refsource: "MISC",
                     url: "https://httpd.apache.org/security/vulnerabilities_24.html",
                  },
                  {
                     name: "FEDORA-2021-dce7e7738e",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
                  },
                  {
                     name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "FEDORA-2021-e3f6dd670d",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
                  },
                  {
                     name: "[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
                  },
                  {
                     name: "[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E",
                  },
                  {
                     name: "DSA-4982",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-4982",
                  },
                  {
                     name: "[httpd-users] 20211019 [users@httpd] Regarding CVE-2021-40438",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20211019 Re: [users@httpd] Regarding CVE-2021-40438",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
                     refsource: "CISCO",
                     url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://www.tenable.com/security/tns-2021-17",
                     refsource: "CONFIRM",
                     url: "https://www.tenable.com/security/tns-2021-17",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20211008-0004/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
                  {
                     name: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
                     refsource: "CONFIRM",
                     url: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
                  },
                  {
                     name: "GLSA-202208-20",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202208-20",
                  },
               ],
            },
            source: {
               discovery: "UNKNOWN",
            },
            timeline: [
               {
                  lang: "en",
                  time: "2021-09-16T00:00:00",
                  value: "2.4.49 released",
               },
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2021-40438",
      datePublished: "2021-09-16T14:40:23.000Z",
      dateReserved: "2021-09-02T00:00:00.000Z",
      dateUpdated: "2025-02-06T21:09:00.866Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-39275

Vulnerability from cvelistv5

Published

2021-09-16 14:40

Modified

2024-08-04 02:06

Severity ?

Summary

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

References

▼	URL	Tags
	https://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2021/dsa-4982	vendor-advisory, x_refsource_DEBIAN
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ	vendor-advisory, x_refsource_CISCO
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20211008-0004/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202208-20	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: Apache HTTP Server 2.4 <

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T02:06:42.326Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://httpd.apache.org/security/vulnerabilities_24.html",
               },
               {
                  name: "FEDORA-2021-dce7e7738e",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
               },
               {
                  name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "FEDORA-2021-e3f6dd670d",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
               },
               {
                  name: "[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
               },
               {
                  name: "DSA-4982",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4982",
               },
               {
                  name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_CISCO",
                     "x_transferred",
                  ],
                  url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
               },
               {
                  name: "GLSA-202208-20",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202208-20",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache HTTP Server",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     lessThanOrEqual: "2.4.48",
                     status: "affected",
                     version: "Apache HTTP Server 2.4",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "ClusterFuzz",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     other: "low",
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Buffer Overflow",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-08-14T01:06:08",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://httpd.apache.org/security/vulnerabilities_24.html",
            },
            {
               name: "FEDORA-2021-dce7e7738e",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
            },
            {
               name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "FEDORA-2021-e3f6dd670d",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
            },
            {
               name: "[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
            },
            {
               name: "DSA-4982",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-4982",
            },
            {
               name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
               tags: [
                  "vendor-advisory",
                  "x_refsource_CISCO",
               ],
               url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
            },
            {
               name: "GLSA-202208-20",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202208-20",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         timeline: [
            {
               lang: "en",
               time: "2021-09-16T00:00:00",
               value: "2.4.49 released",
            },
         ],
         title: "ap_escape_quotes buffer overflow",
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2021-39275",
               STATE: "PUBLIC",
               TITLE: "ap_escape_quotes buffer overflow",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache HTTP Server",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<=",
                                          version_name: "Apache HTTP Server 2.4",
                                          version_value: "2.4.48",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache Software Foundation",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "ClusterFuzz",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.",
                  },
               ],
            },
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: [
               {
                  other: "low",
               },
            ],
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Buffer Overflow",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://httpd.apache.org/security/vulnerabilities_24.html",
                     refsource: "MISC",
                     url: "https://httpd.apache.org/security/vulnerabilities_24.html",
                  },
                  {
                     name: "FEDORA-2021-dce7e7738e",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
                  },
                  {
                     name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "FEDORA-2021-e3f6dd670d",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
                  },
                  {
                     name: "[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
                  },
                  {
                     name: "DSA-4982",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-4982",
                  },
                  {
                     name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
                     refsource: "CISCO",
                     url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20211008-0004/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
                  {
                     name: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
                     refsource: "CONFIRM",
                     url: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
                  },
                  {
                     name: "GLSA-202208-20",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202208-20",
                  },
               ],
            },
            source: {
               discovery: "UNKNOWN",
            },
            timeline: [
               {
                  lang: "en",
                  time: "2021-09-16T00:00:00",
                  value: "2.4.49 released",
               },
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2021-39275",
      datePublished: "2021-09-16T14:40:22",
      dateReserved: "2021-08-18T00:00:00",
      dateUpdated: "2024-08-04T02:06:42.326Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-34798

Vulnerability from cvelistv5

Published

2021-09-16 14:40

Modified

2024-08-04 00:26

Severity ?

Summary

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

References

▼	URL	Tags
	http://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2021/dsa-4982	vendor-advisory, x_refsource_DEBIAN
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ	vendor-advisory, x_refsource_CISCO
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://www.tenable.com/security/tns-2021-17	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20211008-0004/	x_refsource_CONFIRM
	https://kc.mcafee.com/corporate/index?page=content&id=SB10379	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202208-20	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: Apache HTTP Server 2.4 <

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T00:26:54.014Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://httpd.apache.org/security/vulnerabilities_24.html",
               },
               {
                  name: "FEDORA-2021-dce7e7738e",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
               },
               {
                  name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "FEDORA-2021-e3f6dd670d",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
               },
               {
                  name: "[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
               },
               {
                  name: "DSA-4982",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4982",
               },
               {
                  name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_CISCO",
                     "x_transferred",
                  ],
                  url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2021-17",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
               },
               {
                  name: "GLSA-202208-20",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202208-20",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache HTTP Server",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     lessThanOrEqual: "2.4.48",
                     status: "affected",
                     version: "Apache HTTP Server 2.4",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "The issue was discovered by the Apache HTTP security team",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     other: "moderate",
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-476",
                     description: "CWE-476 NULL Pointer Dereference",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-08-14T01:07:32",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://httpd.apache.org/security/vulnerabilities_24.html",
            },
            {
               name: "FEDORA-2021-dce7e7738e",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
            },
            {
               name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "FEDORA-2021-e3f6dd670d",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
            },
            {
               name: "[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
            },
            {
               name: "DSA-4982",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-4982",
            },
            {
               name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
               tags: [
                  "vendor-advisory",
                  "x_refsource_CISCO",
               ],
               url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.tenable.com/security/tns-2021-17",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
            },
            {
               name: "GLSA-202208-20",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202208-20",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         timeline: [
            {
               lang: "en",
               time: "2021-09-16T00:00:00",
               value: "2.4.49 released",
            },
         ],
         title: "NULL pointer dereference in httpd core",
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2021-34798",
               STATE: "PUBLIC",
               TITLE: "NULL pointer dereference in httpd core",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache HTTP Server",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<=",
                                          version_name: "Apache HTTP Server 2.4",
                                          version_value: "2.4.48",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache Software Foundation",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "The issue was discovered by the Apache HTTP security team",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.",
                  },
               ],
            },
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: [
               {
                  other: "moderate",
               },
            ],
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-476 NULL Pointer Dereference",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://httpd.apache.org/security/vulnerabilities_24.html",
                     refsource: "MISC",
                     url: "http://httpd.apache.org/security/vulnerabilities_24.html",
                  },
                  {
                     name: "FEDORA-2021-dce7e7738e",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
                  },
                  {
                     name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "FEDORA-2021-e3f6dd670d",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
                  },
                  {
                     name: "[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html",
                  },
                  {
                     name: "DSA-4982",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-4982",
                  },
                  {
                     name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
                     refsource: "CISCO",
                     url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://www.tenable.com/security/tns-2021-17",
                     refsource: "CONFIRM",
                     url: "https://www.tenable.com/security/tns-2021-17",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20211008-0004/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
                  },
                  {
                     name: "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
                     refsource: "CONFIRM",
                     url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
                  {
                     name: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
                     refsource: "CONFIRM",
                     url: "https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf",
                  },
                  {
                     name: "GLSA-202208-20",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202208-20",
                  },
               ],
            },
            source: {
               discovery: "UNKNOWN",
            },
            timeline: [
               {
                  lang: "en",
                  time: "2021-09-16T00:00:00",
                  value: "2.4.49 released",
               },
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2021-34798",
      datePublished: "2021-09-16T14:40:17",
      dateReserved: "2021-06-16T00:00:00",
      dateUpdated: "2024-08-04T00:26:54.014Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-36160

Vulnerability from cvelistv5

Published

2021-09-16 14:40

Modified

2024-08-04 00:47

Severity ?

Summary

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

References

▼	URL	Tags
	http://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_MISC
	https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x_refsource_FEDORA
	https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2021/dsa-4982	vendor-advisory, x_refsource_DEBIAN
	https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html	mailing-list, x_refsource_MLIST
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ	vendor-advisory, x_refsource_CISCO
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20211008-0004/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://security.gentoo.org/glsa/202208-20	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: Apache HTTP Server 2.4 <

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T00:47:43.818Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://httpd.apache.org/security/vulnerabilities_24.html",
               },
               {
                  name: "[httpd-cvs] 20210916 [httpd-site] branch main updated: Revert \"Add descriptions for CVE-2021-33193 CVE-2021-36160\"",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210916 [httpd-site] branch main updated: Add descriptions for CVE-2021-33193 CVE-2021-36160",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "FEDORA-2021-dce7e7738e",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
               },
               {
                  name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
               },
               {
                  name: "FEDORA-2021-e3f6dd670d",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
               },
               {
                  name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2768-1] uwsgi security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html",
               },
               {
                  name: "[httpd-bugs] 20211005 [Bug 65616] New: CVE-2021-36160 regression",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781%40%3Cbugs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-bugs] 20211005 [Bug 65616] CVE-2021-36160 regression",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c%40%3Cbugs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-bugs] 20211006 [Bug 65616] CVE-2021-36160 regression",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb%40%3Cbugs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-bugs] 20211009 [Bug 65616] CVE-2021-36160 regression",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3%40%3Cbugs.httpd.apache.org%3E",
               },
               {
                  name: "DSA-4982",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4982",
               },
               {
                  name: "[httpd-bugs] 20211011 [Bug 65616] CVE-2021-36160 regression",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a%40%3Cbugs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-bugs] 20211012 [Bug 65616] CVE-2021-36160 regression",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a%40%3Cbugs.httpd.apache.org%3E",
               },
               {
                  name: "[debian-lts-announce] 20211020 [SECURITY] [DLA 2768-2] uwsgi regression update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html",
               },
               {
                  name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_CISCO",
                     "x_transferred",
                  ],
                  url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  name: "GLSA-202208-20",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202208-20",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache HTTP Server",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     changes: [
                        {
                           at: "2.4.30",
                           status: "affected",
                        },
                     ],
                     lessThanOrEqual: "2.4.48",
                     status: "affected",
                     version: "Apache HTTP Server 2.4",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "LI ZHI XIN from NSFocus Security Team",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     other: "moderate",
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125 out of bound read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-08-14T01:06:27",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://httpd.apache.org/security/vulnerabilities_24.html",
            },
            {
               name: "[httpd-cvs] 20210916 [httpd-site] branch main updated: Revert \"Add descriptions for CVE-2021-33193 CVE-2021-36160\"",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210916 [httpd-site] branch main updated: Add descriptions for CVE-2021-33193 CVE-2021-36160",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "FEDORA-2021-dce7e7738e",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
            },
            {
               name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E",
            },
            {
               name: "FEDORA-2021-e3f6dd670d",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
            },
            {
               name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2768-1] uwsgi security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html",
            },
            {
               name: "[httpd-bugs] 20211005 [Bug 65616] New: CVE-2021-36160 regression",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781%40%3Cbugs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-bugs] 20211005 [Bug 65616] CVE-2021-36160 regression",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c%40%3Cbugs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-bugs] 20211006 [Bug 65616] CVE-2021-36160 regression",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb%40%3Cbugs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-bugs] 20211009 [Bug 65616] CVE-2021-36160 regression",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3%40%3Cbugs.httpd.apache.org%3E",
            },
            {
               name: "DSA-4982",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-4982",
            },
            {
               name: "[httpd-bugs] 20211011 [Bug 65616] CVE-2021-36160 regression",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a%40%3Cbugs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-bugs] 20211012 [Bug 65616] CVE-2021-36160 regression",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a%40%3Cbugs.httpd.apache.org%3E",
            },
            {
               name: "[debian-lts-announce] 20211020 [SECURITY] [DLA 2768-2] uwsgi regression update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html",
            },
            {
               name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
               tags: [
                  "vendor-advisory",
                  "x_refsource_CISCO",
               ],
               url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               name: "GLSA-202208-20",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202208-20",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         timeline: [
            {
               lang: "en",
               time: "2021-04-26T00:00:00",
               value: "reported",
            },
            {
               lang: "en",
               time: "2021-09-16T00:00:00",
               value: "2.4.49 release",
            },
         ],
         title: "mod_proxy_uwsgi out of bound read",
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2021-36160",
               STATE: "PUBLIC",
               TITLE: "mod_proxy_uwsgi out of bound read",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache HTTP Server",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<=",
                                          version_name: "Apache HTTP Server 2.4",
                                          version_value: "2.4.48",
                                       },
                                       {
                                          version_affected: "!<",
                                          version_name: "Apache HTTP Server 2.4",
                                          version_value: "2.4.30",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache Software Foundation",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "LI ZHI XIN from NSFocus Security Team",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).",
                  },
               ],
            },
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: [
               {
                  other: "moderate",
               },
            ],
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-125 out of bound read",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://httpd.apache.org/security/vulnerabilities_24.html",
                     refsource: "MISC",
                     url: "http://httpd.apache.org/security/vulnerabilities_24.html",
                  },
                  {
                     name: "[httpd-cvs] 20210916 [httpd-site] branch main updated: Revert \"Add descriptions for CVE-2021-33193 CVE-2021-36160\"",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210916 [httpd-site] branch main updated: Add descriptions for CVE-2021-33193 CVE-2021-36160",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "FEDORA-2021-dce7e7738e",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/",
                  },
                  {
                     name: "[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E",
                  },
                  {
                     name: "FEDORA-2021-e3f6dd670d",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/",
                  },
                  {
                     name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2768-1] uwsgi security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html",
                  },
                  {
                     name: "[httpd-bugs] 20211005 [Bug 65616] New: CVE-2021-36160 regression",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-bugs] 20211005 [Bug 65616] CVE-2021-36160 regression",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-bugs] 20211006 [Bug 65616] CVE-2021-36160 regression",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-bugs] 20211008 [Bug 65616] CVE-2021-36160 regression",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-bugs] 20211009 [Bug 65616] CVE-2021-36160 regression",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E",
                  },
                  {
                     name: "DSA-4982",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-4982",
                  },
                  {
                     name: "[httpd-bugs] 20211011 [Bug 65616] CVE-2021-36160 regression",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-bugs] 20211012 [Bug 65616] CVE-2021-36160 regression",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E",
                  },
                  {
                     name: "[debian-lts-announce] 20211020 [SECURITY] [DLA 2768-2] uwsgi regression update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html",
                  },
                  {
                     name: "20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021",
                     refsource: "CISCO",
                     url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20211008-0004/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20211008-0004/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
                  {
                     name: "GLSA-202208-20",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202208-20",
                  },
               ],
            },
            source: {
               discovery: "UNKNOWN",
            },
            timeline: [
               {
                  lang: "en",
                  time: "2021-04-26T00:00:00",
                  value: "reported",
               },
               {
                  lang: "en",
                  time: "2021-09-16T00:00:00",
                  value: "2.4.49 release",
               },
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2021-36160",
      datePublished: "2021-09-16T14:40:18",
      dateReserved: "2021-07-06T00:00:00",
      dateUpdated: "2024-08-04T00:47:43.818Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_opensuse

cve-2021-40438

Vulnerability from cvelistv5

cve-2021-39275

Vulnerability from cvelistv5

cve-2021-34798

Vulnerability from cvelistv5

cve-2021-36160

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature