High 1 exploited CVE ELSA-2021-3856 1 CVE

Important: httpd security update (Oracle Linux 7)

Published Oct 14, 2021 · Updated Oct 14, 2021

Ecosystem: Oracle Linux

Summary

[2.4.6-97.0.1.1]
- replace index.html with Oracle's index page oracle_index.html

[2.4.6-97.1]
- Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
request uri-path containing 'unix:'

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 7	httpd	0:2.4.6-97.0.1.el7_9.1
Oracle Linux · 7	httpd-devel	0:2.4.6-97.0.1.el7_9.1
Oracle Linux · 7	httpd-manual	0:2.4.6-97.0.1.el7_9.1
Oracle Linux · 7	httpd-tools	0:2.4.6-97.0.1.el7_9.1
Oracle Linux · 7	mod_ldap	0:2.4.6-97.0.1.el7_9.1
Oracle Linux · 7	mod_proxy_html	1:2.4.6-97.0.1.el7_9.1
Oracle Linux · 7	mod_session	0:2.4.6-97.0.1.el7_9.1
Oracle Linux · 7	mod_ssl	1:2.4.6-97.0.1.el7_9.1

Vulnerabilities 1

Critical 9.0

CVE-2021-40438 Exploited · Ransomware Public exploit Scanner template EPSS 100%

mod_proxy SSRF

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Sep 16, 2021
KEV Dec 1, 2021