CVE-2021-44790

CRITICAL

9.8

Beschreibung

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht12/20/2021

Zuletzt geandert5/1/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

apache:http_serverapple:mac_os_xapple:macosdebian:debian_linuxfedoraproject:fedoranetapp:cloud_backuporacle:communications_element_manageroracle:communications_operations_monitororacle:communications_session_report_manageroracle:communications_session_route_manageroracle:http_serveroracle:instantis_enterprisetrackoracle:zfs_storage_appliance_kittenable:tenable.sc

Schwachen (CWE)

CWE-787CWE-787

Referenzen

http://httpd.apache.org/security/vulnerabilities_24.html(security@apache.org)

http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html(security@apache.org)

http://seclists.org/fulldisclosure/2022/May/33(security@apache.org)

http://seclists.org/fulldisclosure/2022/May/35(security@apache.org)

http://seclists.org/fulldisclosure/2022/May/38(security@apache.org)

http://www.openwall.com/lists/oss-security/2021/12/20/4(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/(security@apache.org)

https://security.gentoo.org/glsa/202208-20(security@apache.org)

https://security.netapp.com/advisory/ntap-20211224-0001/(security@apache.org)

https://support.apple.com/kb/HT213255(security@apache.org)

https://support.apple.com/kb/HT213256(security@apache.org)

https://support.apple.com/kb/HT213257(security@apache.org)

https://www.debian.org/security/2022/dsa-5035(security@apache.org)

https://www.oracle.com/security-alerts/cpuapr2022.html(security@apache.org)

https://www.oracle.com/security-alerts/cpujan2022.html(security@apache.org)

https://www.tenable.com/security/tns-2022-01(security@apache.org)

https://www.tenable.com/security/tns-2022-03(security@apache.org)

http://httpd.apache.org/security/vulnerabilities_24.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2022/May/33(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2022/May/35(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2022/May/38(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2021/12/20/4(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202208-20(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20211224-0001/(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213255(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213256(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213257(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2022/dsa-5035(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuapr2022.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujan2022.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.tenable.com/security/tns-2022-01(af854a3a-2127-422b-91ae-364da2661108)

https://www.tenable.com/security/tns-2022-03(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.