Moderate: httpd:2.4 security, bug fix, and enhancement update
Summary
ALSA-2021:4257: Moderate: httpd:2.4 security, bug fix, and enhancement update. Affects mod_http2 versions < 1.15.7-3.module_el8.5.0+2609+b30d9eec. Fixed in 1.15.7-3.module_el8.5.0+2609+b30d9eec. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. It is widely used to serve web content and handle HTTP requests. The Apache HTTP Server is known for its stability, performance, and rich feature set, making it a popular choice for hosting websites and web applications.
Vulnerability Detail
This vulnerability affects the httpd package and includes two security issues:
-
CVE-2021-26690: This vulnerability is related to the mod_session module in Apache HTTP Server. It can lead to a NULL pointer dereference when parsing the Cookie header. An attacker could exploit this vulnerability to cause a denial of service or potentially execute arbitrary code.
-
CVE-2021-30641: This vulnerability is related to unexpected URL matching when the 'MergeSlashes' directive is set to 'OFF' in Apache HTTP Server. It can result in incorrect URL handling and potentially allow attackers to access sensitive information or perform unauthorized actions.
These vulnerabilities pose a moderate risk and could be exploited by remote attackers to compromise the affected web server.
How To Fix
Minimum fixed version
1.15.7-3.module_el8.5.0+2609+b30d9eec
This is the first release that contains the fix.
sudo dnf update mod_http2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The httpd package in AlmaLinux is affected by two moderate security vulnerabilities. It is crucial to update the package to the fixed versions to mitigate the risk of exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mod_http2 →
FAQ
Apache HTTP Server is a widely used web server software that provides a powerful and extensible platform for hosting websites and web applications.
CVE-2021-26690 can lead to a NULL pointer dereference in the mod_session module of Apache HTTP Server. This vulnerability could be exploited by attackers to cause a denial of service or potentially execute arbitrary code.
CVE-2021-30641 can result in unexpected URL matching when the 'MergeSlashes' directive is set to 'OFF' in Apache HTTP Server. This vulnerability could allow attackers to access sensitive information or perform unauthorized actions.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including the ones mentioned in this advisory.
No specific workaround has been provided for these vulnerabilities. It is recommended to update the httpd package to the fixed versions mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for mod_http2.
