var-202106-1875
Vulnerability from variot
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service. Apache HTTP Server is an open source web server of the Apache Foundation in the United States. The server is fast, reliable and extensible through a simple API. A remote attacker could exploit the vulnerability to pass specially crafted data to the application and perform a denial of service (DoS) attack. ========================================================================== Ubuntu Security Notice USN-4994-1 June 21, 2021
apache2 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 21.04
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in Apache HTTP Server.
Software Description: - apache2: Apache HTTP server
Details:
Marc Stern discovered that the Apache mod_proxy_http module incorrectly handled certain requests. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2020-13950)
Antonio Morales discovered that the Apache mod_auth_digest module incorrectly handled certain Digest nonces. (CVE-2020-35452)
Antonio Morales discovered that the Apache mod_session module incorrectly handled certain Cookie headers. (CVE-2021-26690)
Christophe Jaillet discovered that the Apache mod_session module incorrectly handled certain SessionHeader values. (CVE-2021-26691)
Christoph Anton Mitterer discovered that the new MergeSlashes configuration option resulted in unexpected behaviour in certain situations. (CVE-2021-30641)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 21.04: apache2 2.4.46-4ubuntu1.1 apache2-bin 2.4.46-4ubuntu1.1
Ubuntu 20.10: apache2 2.4.46-1ubuntu1.2 apache2-bin 2.4.46-1ubuntu1.2
Ubuntu 20.04 LTS: apache2 2.4.41-4ubuntu3.3 apache2-bin 2.4.41-4ubuntu3.3
Ubuntu 18.04 LTS: apache2 2.4.29-1ubuntu4.16 apache2-bin 2.4.29-1ubuntu4.16
In general, a standard system update will make all the necessary changes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202107-38
https://security.gentoo.org/
Severity: Low Title: Apache: Multiple vulnerabilities Date: July 17, 2021 Bugs: #795231 ID: 202107-38
Synopsis
Multiple vulnerabilities have been found in Apache, the worst of which could result in a Denial of Service condition.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-servers/apache < 2.4.48 >= 2.4.48
Description
Multiple vulnerabilities have been discovered in Apache. Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Workaround
There is no known workaround at this time.
Resolution
All Apache users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/apache-2.4.48"
References
[ 1 ] CVE-2019-17567 https://nvd.nist.gov/vuln/detail/CVE-2019-17567 [ 2 ] CVE-2020-13950 https://nvd.nist.gov/vuln/detail/CVE-2020-13950 [ 3 ] CVE-2020-35452 https://nvd.nist.gov/vuln/detail/CVE-2020-35452 [ 4 ] CVE-2021-26690 https://nvd.nist.gov/vuln/detail/CVE-2021-26690 [ 5 ] CVE-2021-26691 https://nvd.nist.gov/vuln/detail/CVE-2021-26691 [ 6 ] CVE-2021-30641 https://nvd.nist.gov/vuln/detail/CVE-2021-30641 [ 7 ] CVE-2021-31618 https://nvd.nist.gov/vuln/detail/CVE-2021-31618
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202107-38
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2021 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: httpd:2.4 security, bug fix, and enhancement update Advisory ID: RHSA-2021:4257-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4257 Issue date: 2021-11-09 CVE Names: CVE-2021-26690 CVE-2021-30641 ==================================================================== 1. Summary:
An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
Security Fix(es):
-
httpd: mod_session: NULL pointer dereference when parsing Cookie header (CVE-2021-26690)
-
httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted automatically.
- Bugs fixed (https://bugzilla.redhat.com/):
1905613 - mod_ssl does not like valid certificate chain 1934741 - Apache trademark update - new logo 1935742 - [RFE] backport samesite/httponly/secure flags for usertrack 1937334 - SSLProtocol with based virtual hosts 1952557 - mod_proxy_wstunnel.html is a malformed XML 1966729 - CVE-2021-26690 httpd: mod_session: NULL pointer dereference when parsing Cookie header 1966743 - CVE-2021-30641 httpd: Unexpected URL matching with 'MergeSlashes OFF'
- Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source: httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.src.rpm mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.src.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.src.rpm
aarch64: httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm httpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm httpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm httpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm httpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm httpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm mod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm mod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm mod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm mod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm mod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm mod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm mod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm mod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
noarch: httpd-filesystem-2.4.37-41.module+el8.5.0+11772+c8e0c271.noarch.rpm httpd-manual-2.4.37-41.module+el8.5.0+11772+c8e0c271.noarch.rpm
ppc64le: httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm httpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm httpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm httpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm httpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm httpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm mod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm mod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm mod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm mod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm mod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm mod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm mod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm mod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
s390x: httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm httpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm httpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm httpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm httpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm httpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm mod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm mod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm mod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm mod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm mod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm mod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm mod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm mod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
x86_64: httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm httpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm httpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm httpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm httpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm httpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm mod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm mod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm mod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm mod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm mod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm mod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm mod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm mod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-26690 https://access.redhat.com/security/cve/CVE-2021-30641 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYYrer9zjgjWX9erEAQidnxAAljIz0c1qtUxP9lnANeO/5Dkx3XhX1VaN sOO/DRmelj7YeHeelF1HfX3lTfRXZ22/rSzV/EbCMhnRYheTpKq5kCmCanqRmHvo F3CVF2c9wbPpi6b/ww+VzdF4RuhWSY7ZN+oOT8P8rxtX9GcmQ9lYB+HF/BAKVPB7 BHWcJ9eK+wenF931qT6Tg00dfWLJdwEeefZOw1G0VeeUdw4S420LYNM0DHA10HiC 58mzqQMCh2lJ4nlMlK5BHWcTOm0J6AJkoHNrDWHvyAdbtKmK6wgRiSx5WMRmhTin RgXchqrR52GwZwrCCkXhXzMhZ2Ps7G1hgPLXguApDP2AGDFQ/YlTMAImMBGwZw8i jwMq8BL785q4FRKrgCjM0iNBoGYW5rkBtJbiSPeiBuE0VF8ryDp8uwTsREaw/Ybk xKw5kry6Cj2Kl1kuvEI7Px9oFh5Wz1ZImfUaUP+GYDFwUmHdmMZj+bzwGQF21B1M IRpnQH1A8LGF73FWrPX7UBUmzstRadxfbtLXdeOnxxooXbCTwRS4afz4JkZubEZ6 XhrOCJsTM6idFd6NTMYT8f+UhoSojMvqrP27oi4DhiJw4T9Qh5qV0sp3v4+UwD0b VXWRUvWSRk3pVgDPVnhlnK1Ga9GFG5hg0TMo3ssqjq0PknJWcaSIEoFsOkuGxa4t F+wizQuyFY4=Bqs/ -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.
This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Service Pack 9 and includes bug fixes and enhancements. Solution:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link for the update. You must be logged in to download the update.
For the stable distribution (buster), these problems have been fixed in version 2.4.38-3+deb10u5.
We recommend that you upgrade your apache2 packages.
For the detailed security status of apache2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/apache2
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmDnMiAACgkQEMKTtsN8 TjbNqg/9Hrd2EqNC4ijkjHNI/B6K74GgElHVSNcF/vbOp0zmOHaRLaOr06rfXmz+ AYM9nJR4xNJQWaXKFXpCVNvmlaKKbgyiK1LFrslh4aOCVdaVxQIYlYEeOoHthc1K fZawY6qhGf4VrgSkTNhaKakNikpf4lqh7L14LUFSA0b9nRkAy7CtqGuOzgEaUR26 qRUjPewKCeE2QhMgA63ne+XxPUF4I2WYEV8SPdKRfPmMwFlUpwB8bvherjDV+53H ZRs81ZMHk05N1ESI2wYGSR/dh/xYqt/01cXJ636JR39AQR51beIVtxekzwTW/aPE mC2ZY7aH4rsLqcFe3bJcVPQjD0r/fHUVSex1Mnr7mETD5aHAohUfHLEEV1+qR8Cx gz8Z63k0KvmVNe7WetGzwsWnvOXnDdRr63qM0UqEkd3Tre0tLWXjmTUfdUcicAof NsXPtJT8eNwi+E9YmpY5IQRE88uQ2sk2NTGaQ4EetMpLqX5h7brF15OTVxqVbUPP sqAZpgz6lD2Y0P4tXGCYP3u+B48pcNqOS66JJNHO9gJgVu3O+MDQFss+Z5P5JKzI H/KJMv58eFlyP+SsGZbHcDuH/IN8ZMvJA4gsrtHDzRoowFBOS1zDXJjEYdAlzEyq B1SgwN1PXkxPDUAF2+z9dvAeEOrMUUhQhTOC4OnxFxPssSwHEps= =O0O+ -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202106-1875",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "enterprise manager ops center",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "12.4.0.0"
},
{
"model": "instantis enterprisetrack",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "17.3"
},
{
"model": "instantis enterprisetrack",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "17.1"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "10.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "34"
},
{
"model": "http server",
"scope": "lte",
"trust": 1.0,
"vendor": "apache",
"version": "2.4.46"
},
{
"model": "http server",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "2.4.0"
},
{
"model": "zfs storage appliance kit",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "8.8"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "35"
},
{
"model": "instantis enterprisetrack",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "17.2"
},
{
"model": "gnu/linux",
"scope": null,
"trust": 0.8,
"vendor": "debian",
"version": null
},
{
"model": "instantis enterprisetrack",
"scope": null,
"trust": 0.8,
"vendor": "\u30aa\u30e9\u30af\u30eb",
"version": null
},
{
"model": "fedora",
"scope": null,
"trust": 0.8,
"vendor": "fedora",
"version": null
},
{
"model": "zfs storage appliance kit",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30aa\u30e9\u30af\u30eb",
"version": null
},
{
"model": "oracle enterprise manager ops center",
"scope": null,
"trust": 0.8,
"vendor": "\u30aa\u30e9\u30af\u30eb",
"version": null
},
{
"model": "http server",
"scope": null,
"trust": 0.8,
"vendor": "apache",
"version": null
},
{
"model": "http server",
"scope": "gte",
"trust": 0.6,
"vendor": "apache",
"version": "2.4.0,\u003c=2.4.46"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-13199"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"db": "NVD",
"id": "CVE-2021-26690"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.4.46",
"versionStartIncluding": "2.4.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-26690"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "164877"
},
{
"db": "PACKETSTORM",
"id": "164927"
},
{
"db": "PACKETSTORM",
"id": "164928"
}
],
"trust": 0.3
},
"cve": "CVE-2021-26690",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2021-26690",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2022-13199",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2021-26690",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-26690",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2022-13199",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202106-212",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2021-26690",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-13199"
},
{
"db": "VULMON",
"id": "CVE-2021-26690"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-212"
},
{
"db": "NVD",
"id": "CVE-2021-26690"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service. Apache HTTP Server is an open source web server of the Apache Foundation in the United States. The server is fast, reliable and extensible through a simple API. A remote attacker could exploit the vulnerability to pass specially crafted data to the application and perform a denial of service (DoS) attack. ==========================================================================\nUbuntu Security Notice USN-4994-1\nJune 21, 2021\n\napache2 vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 21.04\n- Ubuntu 20.10\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Apache HTTP Server. \n\nSoftware Description:\n- apache2: Apache HTTP server\n\nDetails:\n\nMarc Stern discovered that the Apache mod_proxy_http module incorrectly\nhandled certain requests. This issue only\naffected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2020-13950)\n\nAntonio Morales discovered that the Apache mod_auth_digest module\nincorrectly handled certain Digest nonces. \n(CVE-2020-35452)\n\nAntonio Morales discovered that the Apache mod_session module incorrectly\nhandled certain Cookie headers. \n(CVE-2021-26690)\n\nChristophe Jaillet discovered that the Apache mod_session module\nincorrectly handled certain SessionHeader values. (CVE-2021-26691)\n\nChristoph Anton Mitterer discovered that the new MergeSlashes configuration\noption resulted in unexpected behaviour in certain situations. \n(CVE-2021-30641)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 21.04:\n apache2 2.4.46-4ubuntu1.1\n apache2-bin 2.4.46-4ubuntu1.1\n\nUbuntu 20.10:\n apache2 2.4.46-1ubuntu1.2\n apache2-bin 2.4.46-1ubuntu1.2\n\nUbuntu 20.04 LTS:\n apache2 2.4.41-4ubuntu3.3\n apache2-bin 2.4.41-4ubuntu3.3\n\nUbuntu 18.04 LTS:\n apache2 2.4.29-1ubuntu4.16\n apache2-bin 2.4.29-1ubuntu4.16\n\nIn general, a standard system update will make all the necessary changes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 202107-38\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Low\n Title: Apache: Multiple vulnerabilities\n Date: July 17, 2021\n Bugs: #795231\n ID: 202107-38\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Apache, the worst of which\ncould result in a Denial of Service condition. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 www-servers/apache \u003c 2.4.48 \u003e= 2.4.48 \n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Apache. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Apache users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=www-servers/apache-2.4.48\"\n\nReferences\n==========\n\n[ 1 ] CVE-2019-17567\n https://nvd.nist.gov/vuln/detail/CVE-2019-17567\n[ 2 ] CVE-2020-13950\n https://nvd.nist.gov/vuln/detail/CVE-2020-13950\n[ 3 ] CVE-2020-35452\n https://nvd.nist.gov/vuln/detail/CVE-2020-35452\n[ 4 ] CVE-2021-26690\n https://nvd.nist.gov/vuln/detail/CVE-2021-26690\n[ 5 ] CVE-2021-26691\n https://nvd.nist.gov/vuln/detail/CVE-2021-26691\n[ 6 ] CVE-2021-30641\n https://nvd.nist.gov/vuln/detail/CVE-2021-30641\n[ 7 ] CVE-2021-31618\n https://nvd.nist.gov/vuln/detail/CVE-2021-31618\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202107-38\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2021 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Moderate: httpd:2.4 security, bug fix, and enhancement update\nAdvisory ID: RHSA-2021:4257-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2021:4257\nIssue date: 2021-11-09\nCVE Names: CVE-2021-26690 CVE-2021-30641\n====================================================================\n1. Summary:\n\nAn update for the httpd:2.4 module is now available for Red Hat Enterprise\nLinux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64\n\n3. \n\nSecurity Fix(es):\n\n* httpd: mod_session: NULL pointer dereference when parsing Cookie header\n(CVE-2021-26690)\n\n* httpd: Unexpected URL matching with \u0027MergeSlashes OFF\u0027 (CVE-2021-30641)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 8.5 Release Notes linked from the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted\nautomatically. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1905613 - mod_ssl does not like valid certificate chain\n1934741 - Apache trademark update - new logo\n1935742 - [RFE] backport samesite/httponly/secure flags for usertrack\n1937334 - SSLProtocol with based virtual hosts\n1952557 - mod_proxy_wstunnel.html is a malformed XML\n1966729 - CVE-2021-26690 httpd: mod_session: NULL pointer dereference when parsing Cookie header\n1966743 - CVE-2021-30641 httpd: Unexpected URL matching with \u0027MergeSlashes OFF\u0027\n\n6. Package List:\n\nRed Hat Enterprise Linux AppStream (v. 8):\n\nSource:\nhttpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.src.rpm\nmod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.src.rpm\nmod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.src.rpm\n\naarch64:\nhttpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nhttpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nhttpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nhttpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nhttpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nhttpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nmod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm\nmod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm\nmod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm\nmod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nmod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nmod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm\nmod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm\nmod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm\nmod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nmod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nmod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nmod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nmod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\nmod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm\n\nnoarch:\nhttpd-filesystem-2.4.37-41.module+el8.5.0+11772+c8e0c271.noarch.rpm\nhttpd-manual-2.4.37-41.module+el8.5.0+11772+c8e0c271.noarch.rpm\n\nppc64le:\nhttpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nhttpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nhttpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nhttpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nhttpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nhttpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nmod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm\nmod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm\nmod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm\nmod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nmod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nmod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm\nmod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm\nmod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm\nmod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nmod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nmod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nmod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nmod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\nmod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm\n\ns390x:\nhttpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nhttpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nhttpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nhttpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nhttpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nhttpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nmod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm\nmod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm\nmod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm\nmod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nmod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nmod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm\nmod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm\nmod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm\nmod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nmod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nmod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nmod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nmod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\nmod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm\n\nx86_64:\nhttpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nhttpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nhttpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nhttpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nhttpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nhttpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nmod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm\nmod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm\nmod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm\nmod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nmod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nmod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm\nmod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm\nmod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm\nmod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nmod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nmod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nmod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nmod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\nmod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2021-26690\nhttps://access.redhat.com/security/cve/CVE-2021-30641\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYYrer9zjgjWX9erEAQidnxAAljIz0c1qtUxP9lnANeO/5Dkx3XhX1VaN\nsOO/DRmelj7YeHeelF1HfX3lTfRXZ22/rSzV/EbCMhnRYheTpKq5kCmCanqRmHvo\nF3CVF2c9wbPpi6b/ww+VzdF4RuhWSY7ZN+oOT8P8rxtX9GcmQ9lYB+HF/BAKVPB7\nBHWcJ9eK+wenF931qT6Tg00dfWLJdwEeefZOw1G0VeeUdw4S420LYNM0DHA10HiC\n58mzqQMCh2lJ4nlMlK5BHWcTOm0J6AJkoHNrDWHvyAdbtKmK6wgRiSx5WMRmhTin\nRgXchqrR52GwZwrCCkXhXzMhZ2Ps7G1hgPLXguApDP2AGDFQ/YlTMAImMBGwZw8i\njwMq8BL785q4FRKrgCjM0iNBoGYW5rkBtJbiSPeiBuE0VF8ryDp8uwTsREaw/Ybk\nxKw5kry6Cj2Kl1kuvEI7Px9oFh5Wz1ZImfUaUP+GYDFwUmHdmMZj+bzwGQF21B1M\nIRpnQH1A8LGF73FWrPX7UBUmzstRadxfbtLXdeOnxxooXbCTwRS4afz4JkZubEZ6\nXhrOCJsTM6idFd6NTMYT8f+UhoSojMvqrP27oi4DhiJw4T9Qh5qV0sp3v4+UwD0b\nVXWRUvWSRk3pVgDPVnhlnK1Ga9GFG5hg0TMo3ssqjq0PknJWcaSIEoFsOkuGxa4t\nF+wizQuyFY4=Bqs/\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. This software, such as Apache HTTP Server, is\ncommon to multiple JBoss middleware products, and is packaged under Red Hat\nJBoss Core Services to allow for faster distribution of updates, and for a\nmore consistent update experience. \n\nThis release serves as a replacement for Red Hat JBoss Core Services Apache\nHTTP Server 2.4.37 Service Pack 9 and includes bug fixes and enhancements. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nThe References section of this erratum contains a download link for the\nupdate. You must be logged in to download the update. \n\nFor the stable distribution (buster), these problems have been fixed in\nversion 2.4.38-3+deb10u5. \n\nWe recommend that you upgrade your apache2 packages. \n\nFor the detailed security status of apache2 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/apache2\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmDnMiAACgkQEMKTtsN8\nTjbNqg/9Hrd2EqNC4ijkjHNI/B6K74GgElHVSNcF/vbOp0zmOHaRLaOr06rfXmz+\nAYM9nJR4xNJQWaXKFXpCVNvmlaKKbgyiK1LFrslh4aOCVdaVxQIYlYEeOoHthc1K\nfZawY6qhGf4VrgSkTNhaKakNikpf4lqh7L14LUFSA0b9nRkAy7CtqGuOzgEaUR26\nqRUjPewKCeE2QhMgA63ne+XxPUF4I2WYEV8SPdKRfPmMwFlUpwB8bvherjDV+53H\nZRs81ZMHk05N1ESI2wYGSR/dh/xYqt/01cXJ636JR39AQR51beIVtxekzwTW/aPE\nmC2ZY7aH4rsLqcFe3bJcVPQjD0r/fHUVSex1Mnr7mETD5aHAohUfHLEEV1+qR8Cx\ngz8Z63k0KvmVNe7WetGzwsWnvOXnDdRr63qM0UqEkd3Tre0tLWXjmTUfdUcicAof\nNsXPtJT8eNwi+E9YmpY5IQRE88uQ2sk2NTGaQ4EetMpLqX5h7brF15OTVxqVbUPP\nsqAZpgz6lD2Y0P4tXGCYP3u+B48pcNqOS66JJNHO9gJgVu3O+MDQFss+Z5P5JKzI\nH/KJMv58eFlyP+SsGZbHcDuH/IN8ZMvJA4gsrtHDzRoowFBOS1zDXJjEYdAlzEyq\nB1SgwN1PXkxPDUAF2+z9dvAeEOrMUUhQhTOC4OnxFxPssSwHEps=\n=O0O+\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-26690"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"db": "CNVD",
"id": "CNVD-2022-13199"
},
{
"db": "VULMON",
"id": "CVE-2021-26690"
},
{
"db": "PACKETSTORM",
"id": "163227"
},
{
"db": "PACKETSTORM",
"id": "163231"
},
{
"db": "PACKETSTORM",
"id": "163530"
},
{
"db": "PACKETSTORM",
"id": "164877"
},
{
"db": "PACKETSTORM",
"id": "164927"
},
{
"db": "PACKETSTORM",
"id": "164928"
},
{
"db": "PACKETSTORM",
"id": "169090"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-26690",
"trust": 4.6
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2021/06/10/6",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU96037838",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008067",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "163227",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "163530",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "164877",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "164927",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2022-13199",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021071201",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021071308",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021060713",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021071702",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021111102",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021060321",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2348",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2097",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2153",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.3784",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.3846",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2229",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2341",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2253",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202106-212",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-26690",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "163231",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "164928",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "169090",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-13199"
},
{
"db": "VULMON",
"id": "CVE-2021-26690"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"db": "PACKETSTORM",
"id": "163227"
},
{
"db": "PACKETSTORM",
"id": "163231"
},
{
"db": "PACKETSTORM",
"id": "163530"
},
{
"db": "PACKETSTORM",
"id": "164877"
},
{
"db": "PACKETSTORM",
"id": "164927"
},
{
"db": "PACKETSTORM",
"id": "164928"
},
{
"db": "PACKETSTORM",
"id": "169090"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-212"
},
{
"db": "NVD",
"id": "CVE-2021-26690"
}
]
},
"id": "VAR-202106-1875",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-13199"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-13199"
}
]
},
"last_update_date": "2024-02-12T22:38:25.830000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "FEDORA-2021-e3f6dd670d Oracle Oracle\u00a0Critical\u00a0Patch\u00a0Update",
"trust": 0.8,
"url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.48"
},
{
"title": "Patch for Apache HTTP Server Code Issue Vulnerability (CNVD-2022-13199)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/321246"
},
{
"title": "Apache HTTP Server Fixes for code issue vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=155428"
},
{
"title": "Red Hat: CVE-2021-26690",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=cve-2021-26690"
},
{
"title": "Arch Linux Issues: ",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=cve-2021-26690 log"
},
{
"title": "Debian Security Advisories: DSA-4937-1 apache2 -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=09601b67947dc3a4a0ebcea7ceece30e"
},
{
"title": "Amazon Linux AMI: ALAS-2021-1514",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2021-1514"
},
{
"title": "Amazon Linux 2: ALAS2-2021-1674",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=alas2-2021-1674"
},
{
"title": "PROJET TUTEURE",
"trust": 0.1,
"url": "https://github.com/pierrechrd/py-projet-tut "
},
{
"title": "External Penetration Testing - Holo Corporate Network - TryHackMe - Holo Network",
"trust": 0.1,
"url": "https://github.com/austin-lai/external-penetration-testing-holo-corporate-network-tryhackme-holo-network "
},
{
"title": "Tier 0\nTier 1\nTier 2",
"trust": 0.1,
"url": "https://github.com/totes5706/toteshtb "
},
{
"title": "Skynet",
"trust": 0.1,
"url": "https://github.com/bioly230/thm_skynet "
},
{
"title": "Shodan Search Script",
"trust": 0.1,
"url": "https://github.com/firatesatoglu/shodansearch "
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-13199"
},
{
"db": "VULMON",
"id": "CVE-2021-26690"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-212"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-476",
"trust": 1.0
},
{
"problemtype": "NULL Pointer dereference (CWE-476) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"db": "NVD",
"id": "CVE-2021-26690"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-26690"
},
{
"trust": 1.8,
"url": "https://security.gentoo.org/glsa/202107-38"
},
{
"trust": 1.7,
"url": "http://www.openwall.com/lists/oss-security/2021/06/10/6"
},
{
"trust": 1.7,
"url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
},
{
"trust": 1.7,
"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
},
{
"trust": 1.7,
"url": "https://www.debian.org/security/2021/dsa-4937"
},
{
"trust": 1.7,
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"trust": 1.1,
"url": "http://httpd.apache.org/security/vulnerabilities_24.html"
},
{
"trust": 1.1,
"url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3ccvs.httpd.apache.org%3e"
},
{
"trust": 1.1,
"url": "https://lists.apache.org/thread.html/rae406c1d19c0dfd3103c96923dadac2af1cd0bad6905ab1ede153865%40%3cannounce.httpd.apache.org%3e"
},
{
"trust": 1.1,
"url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3cdev.httpd.apache.org%3e"
},
{
"trust": 1.1,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/spbr6wuybjnachke65spl7tjohx7rhwd/"
},
{
"trust": 1.1,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/zncysr3bxt36fff4xtcpl3hdqk4vp45r/"
},
{
"trust": 1.0,
"url": "https://access.redhat.com/security/cve/cve-2021-26690"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu96037838/"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-30641"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-35452"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-26691"
},
{
"trust": 0.6,
"url": "httpd.apache.org%3e"
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3ccvs."
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/rae406c1d19c0dfd3103c96923dadac2af1cd0bad6905ab1ede153865@%3cannounce."
},
{
"trust": 0.6,
"url": "httpd.apache.org/security/vulnerabilities_24.html"
},
{
"trust": 0.6,
"url": "http://"
},
{
"trust": 0.6,
"url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3cdev."
},
{
"trust": 0.6,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/spbr6wuybjnachke65spl7tjohx7rhwd/"
},
{
"trust": 0.6,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/zncysr3bxt36fff4xtcpl3hdqk4vp45r/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/164927/red-hat-security-advisory-2021-4614-01.html"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021111102"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/163530/gentoo-linux-security-advisory-202107-38.html"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021060713"
},
{
"trust": 0.6,
"url": "http-server-used-by-websphere-application-server-3/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2229"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3846"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2348"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021071201"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/163227/ubuntu-security-notice-usn-4994-1.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2253"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2341"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2153"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021071308"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2097"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021071702"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3784"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/164877/red-hat-security-advisory-2021-4257-03.html"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021060321"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-13950"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-17567"
},
{
"trust": 0.3,
"url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2021-30641"
},
{
"trust": 0.3,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.2,
"url": "https://ubuntu.com/security/notices/usn-4994-1"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-31618"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-14155"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14155"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2019-17567"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-26691"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2019-20838"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-3712"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-23841"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-23840"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-23841"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-23840"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-20838"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-13950"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-35452"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3712"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/476.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/austin-lai/external-penetration-testing-holo-corporate-network-tryhackme-holo-network"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache2/2.4.46-1ubuntu1.2"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache2/2.4.29-1ubuntu4.16"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache2/2.4.41-4ubuntu3.3"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/apache2/2.4.46-4ubuntu1.1"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-4994-2"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:4257"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:4614"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:4613"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/apache2"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-13199"
},
{
"db": "VULMON",
"id": "CVE-2021-26690"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"db": "PACKETSTORM",
"id": "163227"
},
{
"db": "PACKETSTORM",
"id": "163231"
},
{
"db": "PACKETSTORM",
"id": "163530"
},
{
"db": "PACKETSTORM",
"id": "164877"
},
{
"db": "PACKETSTORM",
"id": "164927"
},
{
"db": "PACKETSTORM",
"id": "164928"
},
{
"db": "PACKETSTORM",
"id": "169090"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-212"
},
{
"db": "NVD",
"id": "CVE-2021-26690"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2022-13199"
},
{
"db": "VULMON",
"id": "CVE-2021-26690"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"db": "PACKETSTORM",
"id": "163227"
},
{
"db": "PACKETSTORM",
"id": "163231"
},
{
"db": "PACKETSTORM",
"id": "163530"
},
{
"db": "PACKETSTORM",
"id": "164877"
},
{
"db": "PACKETSTORM",
"id": "164927"
},
{
"db": "PACKETSTORM",
"id": "164928"
},
{
"db": "PACKETSTORM",
"id": "169090"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-212"
},
{
"db": "NVD",
"id": "CVE-2021-26690"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-02-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-13199"
},
{
"date": "2021-06-10T00:00:00",
"db": "VULMON",
"id": "CVE-2021-26690"
},
{
"date": "2022-03-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"date": "2021-06-21T19:22:22",
"db": "PACKETSTORM",
"id": "163227"
},
{
"date": "2021-06-22T19:17:24",
"db": "PACKETSTORM",
"id": "163231"
},
{
"date": "2021-07-17T10:11:11",
"db": "PACKETSTORM",
"id": "163530"
},
{
"date": "2021-11-10T17:11:10",
"db": "PACKETSTORM",
"id": "164877"
},
{
"date": "2021-11-11T14:53:11",
"db": "PACKETSTORM",
"id": "164927"
},
{
"date": "2021-11-11T14:53:24",
"db": "PACKETSTORM",
"id": "164928"
},
{
"date": "2021-07-28T19:12:00",
"db": "PACKETSTORM",
"id": "169090"
},
{
"date": "2021-06-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-212"
},
{
"date": "2021-06-10T07:15:07.543000",
"db": "NVD",
"id": "CVE-2021-26690"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-02-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-13199"
},
{
"date": "2023-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2021-26690"
},
{
"date": "2022-03-03T03:25:00",
"db": "JVNDB",
"id": "JVNDB-2021-008067"
},
{
"date": "2021-11-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202106-212"
},
{
"date": "2023-11-07T03:31:47.720000",
"db": "NVD",
"id": "CVE-2021-26690"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "163227"
},
{
"db": "PACKETSTORM",
"id": "163231"
},
{
"db": "CNNVD",
"id": "CNNVD-202106-212"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache\u00a0HTTP\u00a0Server\u00a0 of \u00a0mod_session\u00a0 In \u00a0NULL\u00a0 Pointer dereference vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-008067"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202106-212"
}
],
"trust": 0.6
}
}
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.