MGASA-2021-0439

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2021-0439.html
Import Source
https://advisories.mageia.org/MGASA-2021-0439.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2021-0439
Related
Published
2021-09-23T04:49:29Z
Modified
2021-09-23T04:07:12Z
Summary
Updated apache packages fix security vulnerability
Details

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. (CVE-2021-33193)

Malformed requests may cause the server to dereference a NULL pointer. (CVE-2021-34798)

A carefully crafted request uri-path can cause modproxyuwsgi to read above the allocated memory and crash (DoS). (CVE-2021-36160)

apescapequotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. (CVE-2021-39275)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. (CVE-2021-40438)

References
Credits

Affected packages

Mageia:8 / apache

Package

Name
apache
Purl
pkg:rpm/mageia/apache?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.49-1.mga8

Ecosystem specific 

{
    "section": "core"
}