Red Hat Security Advisory

RHSA-2021:3816

httpd:2.4 security update

Released 2021-10-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-39.module+el8.4.0+12865+a7065a39.1.aarch64::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+12865+a7065a39.1.ppc64le::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+12865+a7065a39.1.s390x::httpd:2.4 +38

TI-2021-17490 CVE-2021-40438 · GHSA-rwxq-58vm-3v2j

CRITICAL 98KEV

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.99999 Published 2021-09-16 Fixed CWE-918

TI-2021-08375 CVE-2021-26691 · GHSA-j3ww-p97m-gh9x

HIGH 79

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.68067 Published 2021-06-10 Partial fix CWE-122