Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31618: A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service. 1968013: CVE-2021-31618 httpd: NULL pointer dereference on specially crafted HTTP/2 request
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | httpd | 0:2.4.46-2.amzn2 |
| Amazon Linux · 2 | httpd-debuginfo | 0:2.4.46-2.amzn2 |
| Amazon Linux · 2 | httpd-devel | 0:2.4.46-2.amzn2 |
| Amazon Linux · 2 | httpd-filesystem | 0:2.4.46-2.amzn2 |
| Amazon Linux · 2 | httpd-manual | 0:2.4.46-2.amzn2 |
| Amazon Linux · 2 | httpd-tools | 0:2.4.46-2.amzn2 |
| Amazon Linux · 2 | mod_ldap | 0:2.4.46-2.amzn2 |
| Amazon Linux · 2 | mod_md | 0:2.4.46-2.amzn2 |
| Amazon Linux · 2 | mod_proxy_html | 1:2.4.46-2.amzn2 |
| Amazon Linux · 2 | mod_session | 0:2.4.46-2.amzn2 |
| Amazon Linux · 2 | mod_ssl | 1:2.4.46-2.amzn2 |
Vulnerabilities 1
-
Unscored —CVE-2021-31618 EPSS 52%
NULL pointer dereference on specially crafted HTTP/2 request
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-31618.html