Summary
Multiple vulnerabilities were identified in the Apache HTTP Server software. These include NULL Pointer Dereferencing, Out-of-bounds Write and Server-Side Request Forgery related vulnerabilities.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
Vulnerabilities 3
-
Critical 9.0
mod_proxy SSRF
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
KEV Dec 1, 2021 -
Unscored —CVE-2021-34798 EPSS 65%
NULL pointer dereference in httpd core
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
-
Unscored —CVE-2021-39275 EPSS 39%
ap_escape_quotes buffer overflow
ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.
Revision history
-
#2
Added fix for SINEC NMS
-
#1
Publication Date
References
-
SSA-685781: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf
-
SSA-685781: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-685781.txt