Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021
On September 16, 2021, the Apache Software Foundation disclosed five vulnerabilities affecting the Apache HTTP Server (httpd) 2.4.48 and earlier releases. For a description of these vulnerabilities, see the Apache HTTP Server 2.4.49 section ["https://httpd.apache.org/security/vulnerabilities_24.html#2.4.49"] of the Apache HTTP Server 2.4 vulnerabilities webpage. This advisory will be updated as additional information becomes available.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-40438US | critical9.0OT critical | KEV | ||
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. | ||||
| CVE-2021-39275US | critical9.8 | — | ||
ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules m… | ||||
| CVE-2021-36160US | high7.5 | — | ||
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (… | ||||
| CVE-2021-34798US | high7.5 | — | ||
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. | ||||
| CVE-2021-33193US | high7.5 | — | ||
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Se… | ||||
references
External citations — patches, advisories, analysis.
- Cisco Bug Search Toolexternal
- CSCvz83342external
- CSCvz91266external
- CSCvz91270external
- CSCwa01545external
- CSCwa15291external
- CSCwa16137external
- CSCwa33060external
remediations (14)
- FixedCisco Expressway
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Firepower Extensible Operating System (FXOS)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Firepower Extensible Operating System (FXOS)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Firepower Extensible Operating System (FXOS)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Firepower Extensible Operating System (FXOS)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Firepower Extensible Operating System (FXOS)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco TelePresence Video Communication Server (VCS) Expressway
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco Expressway
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
- WorkaroundCisco Firepower Extensible Operating System (FXOS)
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
- WorkaroundCisco Firepower Extensible Operating System (FXOS)
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
- WorkaroundCisco Firepower Extensible Operating System (FXOS)
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
- WorkaroundCisco Firepower Extensible Operating System (FXOS)
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
- WorkaroundCisco Firepower Extensible Operating System (FXOS)
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
- WorkaroundCisco TelePresence Video Communication Server (VCS) Expressway
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan