Red Hat Security Advisory

RHSA-2021:4257

httpd:2.4 security, bug fix, and enhancement update

Released 2021-11-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64::httpd:2.4, httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le::httpd:2.4, httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x::httpd:2.4 +38

Fixes 2 records

TI-2021-08374 CVE-2021-26690 · GHSA-f669-j28w-pjvg

mod_session NULL pointer dereference

HIGH 69

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.65067 Published 2021-06-10 Partial fix CWE-476

TI-2021-11032 CVE-2021-30641 · GHSA-jfgv-4796-2jw7

Unexpected URL matching with 'MergeSlashes OFF'

MEDIUM 56

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.51765 Published 2021-06-10 Partial fix