High ELSA-2021-9541 1 CVE

Important: httpd security update (Oracle Linux 7)

Published Nov 4, 2021 · Updated Nov 4, 2021

Ecosystem: Oracle Linux

Summary

[2.4.6-97.0.3.1]
- mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 7	httpd	0:2.4.6-97.0.3.el7_9.1
Oracle Linux · 7	httpd-devel	0:2.4.6-97.0.3.el7_9.1
Oracle Linux · 7	httpd-manual	0:2.4.6-97.0.3.el7_9.1
Oracle Linux · 7	httpd-tools	0:2.4.6-97.0.3.el7_9.1
Oracle Linux · 7	mod_ldap	0:2.4.6-97.0.3.el7_9.1
Oracle Linux · 7	mod_proxy_html	1:2.4.6-97.0.3.el7_9.1
Oracle Linux · 7	mod_session	0:2.4.6-97.0.3.el7_9.1
Oracle Linux · 7	mod_ssl	1:2.4.6-97.0.3.el7_9.1

Vulnerabilities 1

Unscored —

CVE-2021-26690 Public exploit EPSS 65%

mod_session NULL pointer dereference

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Jun 10, 2021