Apache HTTP Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• Critical 9.0
  CVE-2021-40438 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  mod_proxy SSRF

  A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Sep 16, 2021

  KEV Dec 1, 2021
• Unscored —
  CVE-2021-20325

  Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.…

  Feb 18, 2022
• Unscored —
  CVE-2021-34798 EPSS 65%

  NULL pointer dereference in httpd core

  Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Sep 16, 2021
• Unscored —
  CVE-2021-36160 EPSS 64%

  mod_proxy_uwsgi out of bound read

  A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Sep 16, 2021
• Unscored —
  CVE-2021-39275 EPSS 39%

  ap_escape_quotes buffer overflow

  ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Sep 16, 2021

Revision history

1. 2025-01-29 #42

   Neue Updates von openSUSE aufgenommen

2. 2023-08-17 #41

   Neue Updates von F5 aufgenommen

3. 2023-08-13 #40

   Neue Updates von HP aufgenommen

4. 2022-10-26 #39

   Neue Updates von Red Hat aufgenommen

5. 2022-09-29 #38

   Neue Updates von Red Hat aufgenommen

6. 2022-09-20 #37

   Neue Updates von HP aufgenommen

7. 2022-09-13 #36

   Neue Updates von BROCADE aufgenommen

8. 2022-08-14 #35

   Neue Updates von Gentoo aufgenommen

9. 2022-07-19 #34

   Neue Updates von AVAYA aufgenommen

10. 2022-05-17 #33

    Neue Updates von Oracle Linux aufgenommen

11. 2022-05-10 #32

    Neue Updates von Red Hat aufgenommen

12. 2022-04-24 #31

    Neue Updates von HCL aufgenommen

13. 2022-03-16 #30

    Neue Updates von Oracle Linux und AVAYA aufgenommen

14. 2022-03-15 #29

    Neue Updates von Red Hat aufgenommen

15. 2022-01-27 #28

    Neue Updates von AVAYA aufgenommen

16. 2022-01-25 #27

    Neue Updates von Oracle Linux und CentOS aufgenommen

17. 2022-01-19 #26

    Neue Updates von Oracle Linux aufgenommen

18. 2022-01-16 #25

    Neue Updates von Red Hat aufgenommen

19. 2022-01-05 #24

    Neue Updates von Oracle Linux aufgenommen

20. 2021-12-22 #23

    Neue Updates von NetApp aufgenommen

21. 2021-12-20 #22

    Neue Updates von Cisco aufgenommen

22. 2021-12-15 #21

    Neue Updates von Oracle Linux aufgenommen

23. 2021-11-29 #20

    Exploit aufgenommen

24. 2021-11-24 #19

    Neue Updates von Cisco aufgenommen

25. 2021-11-18 #18

    Neue Updates von Oracle Linux aufgenommen

References

• Apache Security Advisory vom 2021-09-16
  https://httpd.apache.org/security/vulnerabilities_24.html
• Ubuntu Security Notice USN-5090-1 vom 2021-09-27
  https://ubuntu.com/security/notices/USN-5090-1
• Ubuntu Security Notice USN-5090-2 vom 2021-09-27
  https://ubuntu.com/security/notices/USN-5090-2
• SUSE Security Update SUSE-SU-2021:14811-1 vom 2021-09-27
  https://lists.suse.com/pipermail/sle-security-updates/2021-September/009511.html
• Ubuntu Security Notice USN-5090-3 vom 2021-09-28
  https://ubuntu.com/security/notices/USN-5090-3
• Ubuntu Security Notice USN-5090-4 vom 2021-09-28
  https://ubuntu.com/security/notices/USN-5090-4
• Debian Security Advisory DLA-2768 vom 2021-09-30
  https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
• Debian Security Advisory DLA-2776 vom 2021-10-02
  https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
• SUSE Security Update SUSE-SU-2021:3299-1 vom 2021-10-06
  https://lists.suse.com/pipermail/sle-security-updates/2021-October/009537.html
• Red Hat Security Advisory RHSA-2021:3745 vom 2021-10-07
  https://access.redhat.com/errata/RHSA-2021:3745
• Red Hat Security Advisory RHSA-2021:3746 vom 2021-10-07
  https://access.redhat.com/errata/RHSA-2021:3746
• Debian Security Advisory DSA-4982 vom 2021-10-10
  https://www.debian.org/security/2021/dsa-4982
• Red Hat Security Advisory RHSA-2021:3754 vom 2021-10-11
  https://access.redhat.com/errata/RHSA-2021:3754
• SUSE Security Update SUSE-SU-2021:3335-1 vom 2021-10-12
  https://lists.suse.com/pipermail/sle-security-updates/2021-October/009564.html
• F5 Security Advisory K72382141 vom 2021-10-13
  https://support.f5.com/csp/article/K72382141?utm_source=f5support&utm_medium=RSS
• Red Hat Security Advisory RHSA-2021:3816 vom 2021-10-12
  https://access.redhat.com/errata/RHSA-2021:3816
• Red Hat Security Advisory RHSA-2021:3837 vom 2021-10-13
  https://access.redhat.com/errata/RHSA-2021:3837
• Red Hat Security Advisory RHSA-2021:3836 vom 2021-10-13
  https://access.redhat.com/errata/RHSA-2021:3836
• Oracle Linux Security Advisory ELSA-2021-3816 vom 2021-10-13
  http://linux.oracle.com/errata/ELSA-2021-3816.html
• Red Hat Security Advisory RHSA-2021:3856 vom 2021-10-14
  https://access.redhat.com/errata/RHSA-2021:3856
• Oracle Linux Security Advisory ELSA-2021-3856 vom 2021-10-15
  http://linux.oracle.com/errata/ELSA-2021-3856.html
• AVAYA Security Advisory ASA-2021-119 vom 2021-10-15
  https://downloads.avaya.com/css/P8/documents/101078189
• Amazon Linux Security Advisory ALAS-2021-1543 vom 2021-10-15
  https://alas.aws.amazon.com/ALAS-2021-1543.html
• Amazon Linux Security Advisory ALAS-2021-1716 vom 2021-10-15
  https://alas.aws.amazon.com/AL2/ALAS-2021-1716.html
• SUSE Security Update SUSE-SU-2021:3522-1 vom 2021-10-26
  https://lists.suse.com/pipermail/sle-security-updates/2021-October/009646.html
• Red Hat Security Advisory RHSA-2021:4537 vom 2021-11-10
  https://access.redhat.com/errata/RHSA-2021:4537
• Hitachi Vulnerability Information HITACHI-SEC-2021-139 vom 2021-11-12
  https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2021-139/index.html
• CentOS Security Advisory CESA-2021:3856 vom 2021-11-17
  https://lists.centos.org/pipermail/centos-announce/2021-November/048391.html
• Oracle Linux Security Advisory ELSA-2021-4537 vom 2021-11-18
  https://linux.oracle.com/errata/ELSA-2021-4537.html
• Cisco Security Advisory CISCO-SA-APACHE-HTTPD-2 vom 2021-11-24
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
• Security Affairs vom 2021-11-29
  https://securityaffairs.co/wordpress/125107/hacking/cve-2021-40438-apache-http-server-attacks.html
• Oracle Linux Security Advisory ELSA-2021-9619 vom 2021-12-16
  http://linux.oracle.com/errata/ELSA-2021-9619.html
• Cisco Security Advisory CISCO-SA-APACHE-HTTPD-2.4.49-VWL69SWQ vom 2021-12-21
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
• NetApp Security Advisory NTAP-20211008-0004 vom 2021-12-22
  https://security.netapp.com/advisory/ntap-20211008-0004/
• Oracle Linux Security Advisory ELSA-2022-9005 vom 2022-01-06
  https://linux.oracle.com/errata/ELSA-2022-9005.html
• Red Hat Security Advisory RHSA-2022:0143 vom 2022-01-17
  https://access.redhat.com/errata/RHSA-2022:0143
• Oracle Linux Security Advisory ELSA-2022-0143 vom 2022-01-19
  http://linux.oracle.com/errata/ELSA-2022-0143.html
• Oracle Linux Security Advisory ELSA-2022-0258 vom 2022-01-26
  http://linux.oracle.com/errata/ELSA-2022-0258.html
• CentOS Security Advisory CESA-2022:0143 vom 2022-01-25
  https://lists.centos.org/pipermail/centos-announce/2022-January/073551.html
• AVAYA Security Advisory ASA-2022-003 vom 2027-01-18
  https://downloads.avaya.com/css/P8/documents/101079910
• Red Hat Security Advisory RHSA-2022:0891 vom 2022-03-15
  https://access.redhat.com/errata/RHSA-2022:0891
• Oracle Linux Security Advisory ELSA-2022-0891 vom 2022-03-16
  http://linux.oracle.com/errata/ELSA-2022-0891.html
• AVAYA Security Advisory ASA-2022-029 vom 2022-03-15
  https://downloads.avaya.com/css/P8/documents/101080898
• HCL Article KB0097639 vom 2022-04-23
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097639
• Red Hat Security Advisory RHSA-2022:1915 vom 2022-05-10
  https://access.redhat.com/errata/RHSA-2022:1915
• Oracle Linux Security Advisory ELSA-2022-1915 vom 2022-05-17
  https://linux.oracle.com/errata/ELSA-2022-1915.html
• AVAYA Security Advisory ASA-2022-053 vom 2022-07-18
  https://downloads.avaya.com/css/P8/documents/101082704
• Gentoo Linux Security Advisory GLSA-202208-20 vom 2022-08-14
  https://security.gentoo.org/glsa/202208-20
• Brocade Security Advisory BSA-2022-1599 vom 2022-09-14
  https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1599
• Brocade Security Advisory BSA-2022-1597 vom 2022-09-14
  https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1597
• HPE SECURITY BULLETIN HPESBST04367 rev.1 vom 2022-09-21
  https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-hpesbst04367en_us
• Red Hat Security Advisory RHSA-2022:6753 vom 2022-09-29
  https://access.redhat.com/errata/RHSA-2022:6753
• Red Hat Security Advisory RHSA-2022:7143 vom 2022-10-27
  https://access.redhat.com/errata/RHSA-2022:7143
• Red Hat Security Advisory RHSA-2022:7144 vom 2022-10-27
  https://access.redhat.com/errata/RHSA-2022:7144
• HPE Security Bulletin
  https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-hpesbst04494en_us
• F5 Security Advisory K72382141 vom 2023-08-17
  https://my.f5.com/manage/s/article/K72382141
• openSUSE Security Update OPENSUSE-SU-2025:14708-1 vom 2025-01-29
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5RZA3QZZUTFNFHPJESYW5I7GDZGWBEQF/