Summary
[2.4.37-43.0.3.3]
- Resolves: CVE-2021-33193 a crafted method sent through HTTP/2 will
bypass validation [Orabug: 33942809]
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | httpd | 0:2.4.37-43.0.3.module+el8.5.0+20624+5d3b49d0.3 |
| Oracle Linux · 8 | httpd-devel | 0:2.4.37-43.0.3.module+el8.5.0+20624+5d3b49d0.3 |
| Oracle Linux · 8 | httpd-filesystem | 0:2.4.37-43.0.3.module+el8.5.0+20624+5d3b49d0.3 |
| Oracle Linux · 8 | httpd-manual | 0:2.4.37-43.0.3.module+el8.5.0+20624+5d3b49d0.3 |
| Oracle Linux · 8 | httpd-tools | 0:2.4.37-43.0.3.module+el8.5.0+20624+5d3b49d0.3 |
| Oracle Linux · 8 | mod_ldap | 0:2.4.37-43.0.3.module+el8.5.0+20624+5d3b49d0.3 |
| Oracle Linux · 8 | mod_proxy_html | 1:2.4.37-43.0.3.module+el8.5.0+20624+5d3b49d0.3 |
| Oracle Linux · 8 | mod_session | 0:2.4.37-43.0.3.module+el8.5.0+20624+5d3b49d0.3 |
| Oracle Linux · 8 | mod_ssl | 1:2.4.37-43.0.3.module+el8.5.0+20624+5d3b49d0.3 |
Vulnerabilities 1
-
Unscored —CVE-2021-33193 EPSS 46%
Request splitting via HTTP/2 method injection and mod_proxy
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.