Red Hat Security Advisory

RHSA-2022:0143

httpd security update

Released 2022-01-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-97.el7_9.4, httpd-devel-2.4.6-97.el7_9.4, httpd-manual-2.4.6-97.el7_9.4 +5
Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-97.el7_9.4, httpd-devel-2.4.6-97.el7_9.4, httpd-manual-2.4.6-97.el7_9.4 +5
Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-97.el7_9.4, httpd-devel-2.4.6-97.el7_9.4, httpd-manual-2.4.6-97.el7_9.4 +3
Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-97.el7_9.4, mod_proxy_html-1:2.4.6-97.el7_9.4
Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-97.el7_9.4, httpd-devel-2.4.6-97.el7_9.4, httpd-manual-2.4.6-97.el7_9.4 +3
Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-97.el7_9.4, mod_proxy_html-1:2.4.6-97.el7_9.4

TI-2021-20274 CVE-2021-44790 · GHSA-c547-2659-q37g

CRITICAL 86

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9684 Published 2021-12-20 Partial fix CWE-787

TI-2021-08375 CVE-2021-26691 · GHSA-j3ww-p97m-gh9x

HIGH 79

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.68067 Published 2021-06-10 Partial fix CWE-122

TI-2021-16656 CVE-2021-39275 · GHSA-p59c-pqfv-4fwc

HIGH 69

ap_escape_quotes() may write beyond the end of a buffer when given malicious input.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.39402 Published 2021-09-16 Partial fix CWE-787

TI-2021-13795 CVE-2021-34798 · GHSA-6cg7-x9gh-4wf6

HIGH 69

Malformed requests may cause the server to dereference a NULL pointer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.64509 Published 2021-09-16 Partial fix CWE-476