DeutschShown in its original language — a full translation is planned for a future version.
Apache HTTP Server: Mehrere Schwachstellen
view advisory published 2021-06-09
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder sonstige Auswirkungen zu verursachen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-20325US | critical9.8 | — | ||
Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions sh… | ||||
| CVE-2021-30641US | medium5.3 | — | ||
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' | ||||
| CVE-2021-26691US | critical9.8 | — | ||
In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow | ||||
| CVE-2021-26690US | high7.5 | Exploit | ||
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of… | ||||
| CVE-2020-35452US | high7.3 | — | ||
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, n… | ||||
| CVE-2020-13950US | high7.5 | — | ||
Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-E… | ||||
| CVE-2020-13938US | medium5.5OT elevated | — | ||
Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows | ||||
| CVE-2019-17567US | medium5.3 | — | ||
Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardl… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2021-3816 vom 2021-10-13external
- Oracle Linux Security Advisory ELSA-2021-9545 vom 2021-11-12external
- Oracle Linux Security Advisory ELSA-2022-0143 vom 2022-01-19external
- Oracle Linux Security Advisory ELSA-2022-1045 vom 2022-03-24external
- Oracle Linux Security Advisory ELSA-2022-5163 vom 2022-06-24external
- Red Hat Security Advisory RHSA-2021:3816 vom 2021-10-12external
- Red Hat Security Advisory RHSA-2021:4257 vom 2021-11-09external
- Red Hat Security Advisory RHSA-2021:4537 vom 2021-11-10external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan