Read the docs
Red Hat Security Advisory

RHSA-2022:7143

Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update

Released 2022-10-26 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 5 records

TI-2021-19915 CVE-2021-44224 · GHSA-92ww-hwmg-qq7p

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

Priority HIGH 76

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.82295 Published 2021-12-20 Partial fix CWE-476
TI-2021-16656 CVE-2021-39275 · GHSA-p59c-pqfv-4fwc

ap_escape_quotes buffer overflow

Priority HIGH 69

ap_escape_quotes() may write beyond the end of a buffer when given malicious input.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.39402 Published 2021-09-16 Partial fix CWE-787
TI-2021-14579 CVE-2021-36160 · GHSA-f4wr-wvqf-r2q5

mod_proxy_uwsgi out of bound read

Priority HIGH 68

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.63721 Published 2021-09-16 Partial fix CWE-125
TI-2021-12741 CVE-2021-33193 · GHSA-p9fg-6rr5-38xc

Request splitting via HTTP/2 method injection and mod_proxy

Priority MEDIUM 63

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46179 Published 2021-08-16 Partial fix
TI-2021-18264 CVE-2021-41524 · GHSA-f29c-hjcq-ww2f

null pointer dereference in h2 fuzzing

Priority MEDIUM 54

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.25804 Published 2021-10-05 Partial fix CWE-476