{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache ist ein Webserver f\u00fcr verschiedene Plattformen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- Windows\n- CISCO Appliance\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0722 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2022-0722.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0722 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0722"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3351 vom 2023-03-03",
        "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00002.html"
      },
      {
        "category": "external",
        "summary": "NIST Vulnerability Database vom 2021-08-16",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33193"
      },
      {
        "category": "external",
        "summary": "github Apache",
        "url": "https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2021:2918-1 vom 2021-09-02",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-September/009388.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2021:2954-1 vom 2021-09-03",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-September/009405.html"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20210917-0004 vom 2021-09-17",
        "url": "https://security.netapp.com/advisory/ntap-20210917-0004/"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5090-1 vom 2021-09-27",
        "url": "https://ubuntu.com/security/notices/USN-5090-1"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5090-4 vom 2021-09-28",
        "url": "https://ubuntu.com/security/notices/USN-5090-4"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5090-3 vom 2021-09-28",
        "url": "https://ubuntu.com/security/notices/USN-5090-3"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2021:3335-1 vom 2021-10-12",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-October/009564.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2021-1543 vom 2021-10-15",
        "url": "https://alas.aws.amazon.com/ALAS-2021-1543.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2021-1716 vom 2021-10-15",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2021-1716.html"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory CISCO-SA-APACHE-HTTPD-2 vom 2021-11-24",
        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory CISCO-SA-APACHE-HTTPD-2.4.49-VWL69SWQ vom 2021-12-21",
        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-1915 vom 2022-05-17",
        "url": "https://linux.oracle.com/errata/ELSA-2022-1915.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-9276 vom 2022-04-13",
        "url": "http://linux.oracle.com/errata/ELSA-2022-9276.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1915 vom 2022-05-10",
        "url": "https://access.redhat.com/errata/RHSA-2022:1915"
      },
      {
        "category": "external",
        "summary": "AVAYA Security Advisory ASA-2022-053 vom 2022-07-18",
        "url": "https://downloads.avaya.com/css/P8/documents/101082704"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202208-20 vom 2022-08-14",
        "url": "https://security.gentoo.org/glsa/202208-20"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6753 vom 2022-09-29",
        "url": "https://access.redhat.com/errata/RHSA-2022:6753"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7144 vom 2022-10-27",
        "url": "https://access.redhat.com/errata/RHSA-2022:7144"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-7647 vom 2022-11-15",
        "url": "https://linux.oracle.com/errata/ELSA-2022-7647.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6840311 vom 2022-11-19",
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-http-cve-2021-33193-and-cve-2021-44224-affects-power-hmc/"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache HTTP Server: Schwachstelle erm\u00f6glicht Denial of Service",
    "tracking": {
      "current_release_date": "2023-03-05T23:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T16:53:15.200+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2022-0722",
      "initial_release_date": "2021-08-16T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2021-08-16T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2021-09-02T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2021-09-05T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2021-09-19T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2021-09-27T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2021-09-28T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2021-10-06T22:00:00.000+00:00",
          "number": "7",
          "summary": "Referenz(en) aufgenommen: FEDORA-2021-5D2D4B6AC5"
        },
        {
          "date": "2021-10-07T22:00:00.000+00:00",
          "number": "8",
          "summary": "Referenz(en) aufgenommen: FEDORA-2021-F94985AFCA"
        },
        {
          "date": "2021-10-12T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2021-10-17T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2021-11-24T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Cisco aufgenommen"
        },
        {
          "date": "2021-12-20T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Cisco aufgenommen"
        },
        {
          "date": "2022-04-13T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2022-05-10T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-05-17T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2022-07-19T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von AVAYA aufgenommen"
        },
        {
          "date": "2022-08-14T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Gentoo aufgenommen"
        },
        {
          "date": "2022-09-29T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-26T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-11-15T23:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2022-11-20T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-03-05T23:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Debian aufgenommen"
        }
      ],
      "status": "final",
      "version": "22"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Apache HTTP Server 2.4.17 - 2.4.48",
            "product": {
              "name": "Apache HTTP Server 2.4.17 - 2.4.48",
              "product_id": "T020167",
              "product_identification_helper": {
                "cpe": "cpe:/a:apache:http_server:2.4.17_-_2.4.48"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Apache"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Avaya Aura Application Enablement Services",
            "product": {
              "name": "Avaya Aura Application Enablement Services",
              "product_id": "T015516",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:aura_application_enablement_services:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Aura Communication Manager",
            "product": {
              "name": "Avaya Aura Communication Manager",
              "product_id": "T015126",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:communication_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Aura Experience Portal",
            "product": {
              "name": "Avaya Aura Experience Portal",
              "product_id": "T015519",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:aura_experience_portal:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Aura Session Manager",
            "product": {
              "name": "Avaya Aura Session Manager",
              "product_id": "T015127",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:session_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Avaya Aura System Manager",
            "product": {
              "name": "Avaya Aura System Manager",
              "product_id": "T015518",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:aura_system_manager:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Avaya"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Cisco Expressway",
            "product": {
              "name": "Cisco Expressway",
              "product_id": "T014329",
              "product_identification_helper": {
                "cpe": "cpe:/a:cisco:expressway_software:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco FXOS",
            "product": {
              "name": "Cisco FXOS",
              "product_id": "660564",
              "product_identification_helper": {
                "cpe": "cpe:/o:cisco:fxos:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Firepower",
            "product": {
              "name": "Cisco Firepower",
              "product_id": "T011337",
              "product_identification_helper": {
                "cpe": "cpe:/a:cisco:firepower:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Prime Collaboration Provisioning",
            "product": {
              "name": "Cisco Prime Collaboration Provisioning",
              "product_id": "T021406",
              "product_identification_helper": {
                "cpe": "cpe:/a:cisco:prime_collaboration:::provisioning"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Prime Infrastructure",
            "product": {
              "name": "Cisco Prime Infrastructure",
              "product_id": "T000756",
              "product_identification_helper": {
                "cpe": "cpe:/a:cisco:prime_infrastructure:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Security Manager (CSM)",
            "product": {
              "name": "Cisco Security Manager (CSM)",
              "product_id": "95918",
              "product_identification_helper": {
                "cpe": "cpe:/a:cisco:security_manager:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Unified Computing System (UCS)",
            "product": {
              "name": "Cisco Unified Computing System (UCS)",
              "product_id": "163824",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:unified_computing_system:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Cisco Wide Area Application Services",
            "product": {
              "name": "Cisco Wide Area Application Services",
              "product_id": "2186",
              "product_identification_helper": {
                "cpe": "cpe:/a:cisco:wide_area_application_services:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Power Hardware Management Console",
            "product": {
              "name": "IBM Power Hardware Management Console",
              "product_id": "5114",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:hardware_management_console:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-33193",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Apache HTTP Server. Eine \u00fcber HTTP/2 gesendete methode wird nur ungen\u00fcgend validiert und von mod_proxy weitergeleitet, was zu einem Request Splitting oder Cache Poisoning f\u00fchren und in der Folge zu einem Denial of Service f\u00fchren kann. Ein entfernter anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "163824",
          "T015519",
          "T015518",
          "67646",
          "T014329",
          "T015516",
          "T011337",
          "5114",
          "T015127",
          "2186",
          "T015126",
          "T012167",
          "T004914",
          "T000756",
          "T020167",
          "2951",
          "T002207",
          "T021406",
          "T000126",
          "660564",
          "95918",
          "398363"
        ]
      },
      "release_date": "2021-08-16T22:00:00Z",
      "title": "CVE-2021-33193"
    }
  ]
}