TI-2021-17490 CVE-2021-40438 · GHSA-rwxq-58vm-3v2j
mod_proxy SSRF
Priority CRITICAL 98KEV
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.
RHSA-2021:3856
httpd security update
Released 2021-10-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-97.el7_9.1, httpd-devel-2.4.6-97.el7_9.1, httpd-manual-2.4.6-97.el7_9.1 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-97.el7_9.1, httpd-devel-2.4.6-97.el7_9.1, httpd-manual-2.4.6-97.el7_9.1 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-97.el7_9.1, httpd-devel-2.4.6-97.el7_9.1, httpd-manual-2.4.6-97.el7_9.1 +3
- Red Hat Enterprise Linux Server AUS (v. 7.2) httpd-2.4.6-40.el7_2.7, httpd-devel-2.4.6-40.el7_2.7, httpd-manual-2.4.6-40.el7_2.7 +2
- Red Hat Enterprise Linux Server AUS (v. 7.3) httpd-2.4.6-45.el7_3.6, httpd-devel-2.4.6-45.el7_3.6, httpd-manual-2.4.6-45.el7_3.6 +2
- Red Hat Enterprise Linux Server AUS (v. 7.4) httpd-2.4.6-67.el7_4.7, httpd-devel-2.4.6-67.el7_4.7, httpd-manual-2.4.6-67.el7_4.7 +3
- Red Hat Enterprise Linux Server AUS (v. 7.6) httpd-2.4.6-89.el7_6.2, httpd-devel-2.4.6-89.el7_6.2, httpd-manual-2.4.6-89.el7_6.2 +3
- Red Hat Enterprise Linux Server AUS (v. 7.7) httpd-2.4.6-90.el7_7.1, httpd-devel-2.4.6-90.el7_7.1, httpd-manual-2.4.6-90.el7_7.1 +3
- Red Hat Enterprise Linux Server E4S (v. 7.6) httpd-2.4.6-89.el7_6.2, httpd-devel-2.4.6-89.el7_6.2, httpd-manual-2.4.6-89.el7_6.2 +3
- Red Hat Enterprise Linux Server E4S (v. 7.7) httpd-2.4.6-90.el7_7.1, httpd-devel-2.4.6-90.el7_7.1, httpd-manual-2.4.6-90.el7_7.1 +3
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-97.el7_9.1, mod_proxy_html-1:2.4.6-97.el7_9.1
- Red Hat Enterprise Linux Server Optional AUS (v. 7.2) mod_ldap-2.4.6-40.el7_2.7, mod_proxy_html-1:2.4.6-40.el7_2.7, mod_session-2.4.6-40.el7_2.7
- Red Hat Enterprise Linux Server Optional AUS (v. 7.3) mod_ldap-2.4.6-45.el7_3.6, mod_proxy_html-1:2.4.6-45.el7_3.6, mod_session-2.4.6-45.el7_3.6
- Red Hat Enterprise Linux Server Optional AUS (v. 7.4) mod_ldap-2.4.6-67.el7_4.7, mod_proxy_html-1:2.4.6-67.el7_4.7
- Red Hat Enterprise Linux Server Optional AUS (v. 7.6) mod_ldap-2.4.6-89.el7_6.2, mod_proxy_html-1:2.4.6-89.el7_6.2
- Red Hat Enterprise Linux Server Optional AUS (v. 7.7) mod_ldap-2.4.6-90.el7_7.1, mod_proxy_html-1:2.4.6-90.el7_7.1
- Red Hat Enterprise Linux Server Optional E4S (v. 7.6) mod_ldap-2.4.6-89.el7_6.2, mod_proxy_html-1:2.4.6-89.el7_6.2
- Red Hat Enterprise Linux Server Optional E4S (v. 7.7) mod_ldap-2.4.6-90.el7_7.1, mod_proxy_html-1:2.4.6-90.el7_7.1
- Red Hat Enterprise Linux Server Optional TUS (v. 7.6) mod_ldap-2.4.6-89.el7_6.2, mod_proxy_html-1:2.4.6-89.el7_6.2
- Red Hat Enterprise Linux Server Optional TUS (v. 7.7) mod_ldap-2.4.6-90.el7_7.1, mod_proxy_html-1:2.4.6-90.el7_7.1
- Red Hat Enterprise Linux Server TUS (v. 7.6) httpd-2.4.6-89.el7_6.2, httpd-devel-2.4.6-89.el7_6.2, httpd-manual-2.4.6-89.el7_6.2 +3
- Red Hat Enterprise Linux Server TUS (v. 7.7) httpd-2.4.6-90.el7_7.1, httpd-devel-2.4.6-90.el7_7.1, httpd-manual-2.4.6-90.el7_7.1 +3
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-97.el7_9.1, httpd-devel-2.4.6-97.el7_9.1, httpd-manual-2.4.6-97.el7_9.1 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-97.el7_9.1, mod_proxy_html-1:2.4.6-97.el7_9.1