Important: httpd:2.4 security update
Summary
ALSA-2022:0258: Important: httpd:2.4 security update. Affects httpd versions < 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma. Fixed in 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Vulnerability Detail
A buffer overflow vulnerability (CVE-2021-44790) has been identified in the mod_lua module of the Apache HTTP Server. This vulnerability could potentially be exploited when parsing multipart content, leading to a buffer overflow. The impact of this vulnerability can vary depending on the specific implementation and configuration of the server. It is important to address this vulnerability to prevent potential remote code execution or denial of service attacks.
How To Fix
Minimum fixed version
2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
It is crucial to update the httpd package to the recommended version or later to address the buffer overflow vulnerability. Failure to do so may expose the server to potential remote code execution or denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httpd →
FAQ
The impact of this vulnerability can vary depending on the specific implementation and configuration of the server. It could potentially allow an attacker to execute arbitrary code or cause a denial of service.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is still important to apply the necessary security updates to mitigate the risk.
No, only versions prior to 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma are affected. It is recommended to update to the latest version to ensure the vulnerability is addressed.
Yes, this vulnerability can be exploited remotely if the server is exposed to the internet and the necessary conditions for exploitation are met.
For more details about this vulnerability, including the CVSS score, acknowledgments, and related information, refer to the CVE page(s) listed in the References section of the advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
