CVE-2021-36160
High
Description
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).
SeverityHigh
CVSS7.5
Exploit probability99. percentile63.7%
Product
Apache Http Server
PublishedSep 16, 2021
First seenSep 16, 2021
Weakness typeCWE-125Out-of-bounds read
How to fix
Update
- apache http_server2.4.49 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
- debian.org/security/2021/dsa-4982
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
- security.gentoo.org/glsa/202208-20
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache http_server | 2.4.30 ≤ v < 2.4.49 | 2.4.49 |
| fedoraproject fedora | 34, 35 | — |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| netapp cloud_backup | No range specified | — |
| netapp clustered_data_ontap | No range specified | — |
| netapp storagegrid | No range specified | — |
| oracle communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | — |
| oracle enterprise_manager_base_platform | 13.4.0.0, 13.5.0.0 | — |
| oracle http_server | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle instantis_enterprisetrack | 17.1, 17.2, 17.3 | — |
| oracle peoplesoft_enterprise_peopletools | 8.58 | — |
| oracle zfs_storage_appliance_kit | 8.8 | — |
| broadcom brocade_fabric_operating_system_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.