CVE-2021-34798
High
Description
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Http Server
PublishedSep 16, 2021
First seenSep 16, 2021
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- siemens sinema_remote_connect_server3.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
- debian.org/security/2021/dsa-4982
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
- security.gentoo.org/glsa/202208-20
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache http_server | v ≤ 2.4.48 | — |
| fedoraproject fedora | 34, 35 | — |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| netapp cloud_backup | No range specified | — |
| netapp clustered_data_ontap | No range specified | — |
| netapp storagegrid | No range specified | — |
| tenable tenable.sc | v ≤ 5.19.1 | — |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | — |
| oracle enterprise_manager_base_platform | 13.4.0.0, 13.5.0.0 | — |
| oracle http_server | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle instantis_enterprisetrack | 17.1, 17.2, 17.3 | — |
| oracle peoplesoft_enterprise_peopletools | 8.58 | — |
| oracle zfs_storage_appliance_kit | 8.8 | — |
| broadcom brocade_fabric_operating_system_firmware | No range specified | — |
| siemens ruggedcom_nms | No range specified | — |
| siemens sinec_nms | No range specified | — |
| siemens sinema_remote_connect_server | v < 3.1 | 3.1 |
| siemens sinema_server | 14.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.