Moderate: httpd:2.4 security and bug fix update
Summary
ALSA-2022:1915: Moderate: httpd:2.4 security and bug fix update. Affects httpd across 2 version ranges.
< 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma
< 2.4.37-47.module_el8.6.0+2935+fb177b09.2
Fixed in 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma or 2.4.37-47.module_el8.6.0+2935+fb177b09.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd package provides the Apache HTTP Server, a powerful, efficient, and extensible web server. It is widely used for hosting websites and applications.
Vulnerability Detail
This vulnerability affects the httpd package and is categorized as moderate. It includes several security fixes:
- CVE-2021-33193: Request splitting via HTTP/2 method injection and mod_proxy
- CVE-2021-36160: Out-of-bounds read via a crafted request uri-path in mod_proxy_uwsgi
- CVE-2021-44224: Possible NULL dereference or SSRF in forward proxy configurations
- CVE-2020-35452: Single zero byte stack overflow in mod_auth_digest
These vulnerabilities can potentially lead to request splitting, out-of-bounds read, NULL dereference, SSRF, and stack overflow attacks, which may result in unauthorized access, information disclosure, or denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update httpd-
< 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma -
< 2.4.37-47.module_el8.6.0+2935+fb177b09.22.4.37-47.module_el8.6.0+2935+fb177b09.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is advised to apply the recommended fix by updating the httpd package.
Conclusion
In conclusion, the httpd package is affected by several moderate vulnerabilities that can potentially lead to unauthorized access, information disclosure, or denial of service. It is crucial to update the package to the recommended version or later to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for httpd →
FAQ
These vulnerabilities can potentially lead to unauthorized access, information disclosure, or denial of service.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
There are no known exploits for these vulnerabilities at the moment. However, it is important to apply the recommended fix to mitigate any potential risks.
You can find more detailed information about these vulnerabilities, including the impact, CVSS score, acknowledgments, and related information, on the respective CVE pages listed in the References section of the vulnerability report.
You can find the AlmaLinux Release Notes linked in the References section of the vulnerability report. These release notes provide detailed information on the changes in the updated version of the httpd package.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
