CVE-2021-44790

CRITICAL

9.8

Description

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie12/20/2021

Derniere modification5/1/2025

Sourcenvd

Observations honeypot0

Produits affectes

apache:http_serverapple:mac_os_xapple:macosdebian:debian_linuxfedoraproject:fedoranetapp:cloud_backuporacle:communications_element_manageroracle:communications_operations_monitororacle:communications_session_report_manageroracle:communications_session_route_manageroracle:http_serveroracle:instantis_enterprisetrackoracle:zfs_storage_appliance_kittenable:tenable.sc

Faiblesses (CWE)

CWE-787CWE-787

References

http://httpd.apache.org/security/vulnerabilities_24.html(security@apache.org)

http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html(security@apache.org)

http://seclists.org/fulldisclosure/2022/May/33(security@apache.org)

http://seclists.org/fulldisclosure/2022/May/35(security@apache.org)

http://seclists.org/fulldisclosure/2022/May/38(security@apache.org)

http://www.openwall.com/lists/oss-security/2021/12/20/4(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/(security@apache.org)

https://security.gentoo.org/glsa/202208-20(security@apache.org)

https://security.netapp.com/advisory/ntap-20211224-0001/(security@apache.org)

https://support.apple.com/kb/HT213255(security@apache.org)

https://support.apple.com/kb/HT213256(security@apache.org)

https://support.apple.com/kb/HT213257(security@apache.org)

https://www.debian.org/security/2022/dsa-5035(security@apache.org)

https://www.oracle.com/security-alerts/cpuapr2022.html(security@apache.org)

https://www.oracle.com/security-alerts/cpujan2022.html(security@apache.org)

https://www.tenable.com/security/tns-2022-01(security@apache.org)

https://www.tenable.com/security/tns-2022-03(security@apache.org)

http://httpd.apache.org/security/vulnerabilities_24.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2022/May/33(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2022/May/35(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2022/May/38(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2021/12/20/4(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202208-20(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20211224-0001/(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213255(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213256(af854a3a-2127-422b-91ae-364da2661108)

https://support.apple.com/kb/HT213257(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2022/dsa-5035(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuapr2022.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujan2022.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.tenable.com/security/tns-2022-01(af854a3a-2127-422b-91ae-364da2661108)

https://www.tenable.com/security/tns-2022-03(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.