Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP9 security update

Fixed packages 49

Vulnerabilities 1

• Critical 9.0
  CVE-2021-40438 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  mod_proxy SSRF

  A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Sep 16, 2021

  KEV Dec 1, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2005117
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3746.json
• report
  https://access.redhat.com/security/cve/CVE-2021-40438
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-40438
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-40438
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog