ALAS2-2021-1678 — Important: mod_http2 security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31618: A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service. 1968013: CVE-2021-31618 httpd: NULL pointer dereference on specially crafted HTTP/2 request

Fixed packages 2

Release	Package	Fixed in
Amazon Linux · 2	mod_http2	0:1.15.19-1.amzn2.0.1
Amazon Linux · 2	mod_http2-debuginfo	0:1.15.19-1.amzn2.0.1

Vulnerabilities 1

Unscored —

CVE-2021-31618 EPSS 52%

NULL pointer dereference on specially crafted HTTP/2 request

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Azure Linux Alpine

Jun 15, 2021

References

web
https://alas.aws.amazon.com/cve/html/CVE-2021-31618.html