Critical Buffer Overflow Vulnerability in Apache2 Package - CVE-2021-44790
Summary
ALPINE-CVE-2021-44790: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). Affects apache2 versions < 2.4.52-r0. Fixed in 2.4.52-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, power, and extensive feature set, including support for various programming languages and modules. However, certain versions of Apache2 are vulnerable to a buffer overflow issue in the mod_lua multipart parser, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2021-44790 arises from a flaw in the mod_lua module of Apache HTTP Server, specifically in the multipart parser used when handling requests. A carefully crafted request body can trigger a buffer overflow, potentially allowing an attacker to execute arbitrary code or crash the server. This vulnerability affects Apache HTTP Server versions 2.4.51 and earlier, and while no known exploits have been reported, the possibility of crafting one exists, making it a critical concern for server administrators.
How To Fix
Minimum fixed version
2.4.52-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the mod_lua module if it is not essential for your application. This can be done by commenting out or removing the relevant LoadModule directive in the Apache configuration file.
Conclusion
The CVE-2021-44790 vulnerability poses a significant risk to Apache HTTP Server installations running versions 2.4.51 and earlier. It is crucial for administrators to update to the patched version 2.4.52-r0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can enhance your security posture by providing real-time vulnerability monitoring.
See every vulnerability recorded for apache2 →
FAQ
CVE-2021-44790 is a critical buffer overflow vulnerability in the mod_lua multipart parser of Apache HTTP Server, affecting versions 2.4.51 and earlier.
You can check your Apache version using the command 'apache2 -v' and compare it against the affected versions listed in the vulnerability details.
If exploited, this vulnerability could allow attackers to execute arbitrary code, potentially leading to server compromise or denial of service.
As of now, the Apache HTTP Server team is not aware of any active exploits for this vulnerability, but it remains a serious risk.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just a manifest file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
