CVE-2021-40438

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.

Security Fix(es):

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).(CVE-2021-36160)

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.(CVE-2021-34798)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.(CVE-2021-40438)

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:" (CVE-2021-40438)

• httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Bug Fix(es):

• proxy rewrite to unix socket fails with CVE-2021-40438 fix (BZ#2017854, BZ#2017855, BZ#2017856)

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:" (CVE-2021-40438)

• httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in AlmaLinux (CVE-2021-20325)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

• SECURITY UPDATE: Buffer overflow with crafted input
  • debian/patches/CVE-2021-39275.patch:ap_escape_quotes() may write beyond the end of a buffer when given malicious input
  • CVE-2021-39275
• SECURITY UPDATE: Malformed requests may cause the server to dereference a NULL pointer
  • debian/patches/CVE-2021-34798.patch: prevent ap_increment_counts() from pointer dereference without check
  • CVE-2021-34798
• SECURITY UPDATE: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.
  • debian/patches/CVE-2021-40438.patch: add checks for the configured UDS path
  • CVE-2021-40438

• CVE-2021-40438: mod_proxy: SSRF via a crafted request uri-path
• CVE-2021-30641: MergeSlashes regression
• CVE-2021-26690: mod_session NULL pointer dereference in parser

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. (CVE-2021-33193)

Malformed requests may cause the server to dereference a NULL pointer. (CVE-2021-34798)

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). (CVE-2021-36160)

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. (CVE-2021-39275)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. (CVE-2021-40438)

This update for apache2 fixes the following issues:

• CVE-2021-40438: Fixed a SRF via a crafted request uri-path. (bsc#1190703)
• CVE-2021-36160: Fixed an out-of-bounds read via a crafted request uri-path. (bsc#1190702)
• CVE-2021-39275: Fixed an out-of-bounds write in ap_escape_quotes() via malicious input. (bsc#1190666)
• CVE-2021-34798: Fixed a NULL pointer dereference via malformed requests. (bsc#1190669)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for apache2 fixes the following issues:

• CVE-2021-40438: Fixed a SRF via a crafted request uri-path. (bsc#1190703)
• CVE-2021-36160: Fixed an out-of-bounds read via a crafted request uri-path. (bsc#1190702)
• CVE-2021-39275: Fixed an out-of-bounds write in ap_escape_quotes() via malicious input. (bsc#1190666)
• CVE-2021-34798: Fixed a NULL pointer dereference via malformed requests. (bsc#1190669)

These are all security issues fixed in the owasp-modsecurity-crs-4.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache2 fixes the following issues:

• CVE-2021-40438: Fixed a SRF via a crafted request uri-path. (bsc#1190703)
• CVE-2021-39275: Fixed an out-of-bounds write in ap_escape_quotes() via malicious input. (bsc#1190666)
• CVE-2021-34798: Fixed a NULL pointer dereference via malformed requests. (bsc#1190669)

This update for apache2 fixes the following issues:

• CVE-2021-40438: Fixed a SRF via a crafted request uri-path. (bsc#1190703)
• CVE-2021-36160: Fixed an out-of-bounds read via a crafted request uri-path. (bsc#1190702)
• CVE-2021-39275: Fixed an out-of-bounds write in ap_escape_quotes() via malicious input. (bsc#1190666)
• CVE-2021-34798: Fixed a NULL pointer dereference via malformed requests. (bsc#1190669)
• CVE-2021-33193: Fixed request splitting via HTTP/2 method injection and mod_proxy. (bsc#1189387)

This update for apache2 fixes the following issues:

• CVE-2021-40438: Fixed a SRF via a crafted request uri-path. (bsc#1190703)
• CVE-2021-36160: Fixed an out-of-bounds read via a crafted request uri-path. (bsc#1190702)
• CVE-2021-39275: Fixed an out-of-bounds write in ap_escape_quotes() via malicious input. (bsc#1190666)
• CVE-2021-34798: Fixed a NULL pointer dereference via malformed requests. (bsc#1190669)

James Kettle discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain crafted methods. A remote attacker could possibly use this issue to perform request splitting or cache poisoning attacks. (CVE-2021-33193)

It was discovered that the Apache HTTP Server incorrectly handled certain malformed requests. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2021-34798)

Li Zhi Xin discovered that the Apache mod_proxy_uwsgi module incorrectly handled certain request uri-paths. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 21.04. (CVE-2021-36160)

It was discovered that the Apache HTTP Server incorrectly handled escaping quotes. If the server was configured with third-party modules, a remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-39275)

It was discovered that the Apache mod_proxy module incorrectly handled certain request uri-paths. A remote attacker could possibly use this issue to cause the server to forward requests to arbitrary origin servers. (CVE-2021-40438)

USN-5090-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that the Apache HTTP Server incorrectly handled certain malformed requests. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2021-34798)

It was discovered that the Apache HTTP Server incorrectly handled escaping quotes. If the server was configured with third-party modules, a remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-39275)

It was discovered that the Apache mod_proxy module incorrectly handled certain request uri-paths. A remote attacker could possibly use this issue to cause the server to forward requests to arbitrary origin servers. (CVE-2021-40438)