CVE-2021-26691

Опубликовано: 04 июн. 2021

Источник: redhat

CVSS3: 8.1

Описание

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

A heap overflow flaw was found In Apache httpd mod_session. The highest threat from this vulnerability is to system availability.

Отчет

This flaw can result in a crash of the httpd child process when mod_session is used.

Меры по смягчению последствий

Only configurations which use the "SessionEnv" directive (which is not widely used) are vulnerable to this flaw. SessionEnv is not enabled in default configuration of httpd package shipped with Red Hat Products.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat Enterprise Linux 6	httpd	Not affected
Red Hat Enterprise Linux 9	httpd	Not affected
Red Hat JBoss Enterprise Application Platform 6	httpd22	Out of support scope
Red Hat JBoss Enterprise Web Server 2	httpd22	Out of support scope
Red Hat Software Collections	httpd24-httpd	Will not fix
JBoss Core Services for RHEL 8	jbcs-httpd24-apr	Fixed	RHSA-2021:4614	10.11.2021
JBoss Core Services for RHEL 8	jbcs-httpd24-apr-util	Fixed	RHSA-2021:4614	10.11.2021
JBoss Core Services for RHEL 8	jbcs-httpd24-curl	Fixed	RHSA-2021:4614	10.11.2021
JBoss Core Services for RHEL 8	jbcs-httpd24-httpd	Fixed	RHSA-2021:4614	10.11.2021
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_cluster-native	Fixed	RHSA-2021:4614	10.11.2021

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Moderate

Дефект:

CWE-119

https://bugzilla.redhat.com/show_bug.cgi?id=1966732httpd: mod_session: Heap overflow via a crafted SessionHeader value

8.1 High

CVSS3

Связанные уязвимости

CVE-2021-26691

CVSS3: 9.8

ubuntu

около 4 лет назад

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVE-2021-26691

CVSS3: 9.8

nvd

около 4 лет назад

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVE-2021-26691

CVSS3: 9.8

msrc

почти 4 года назад

Описание отсутствует

CVE-2021-26691

CVSS3: 9.8

debian

около 4 лет назад

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted Ses ...

GHSA-j3ww-p97m-gh9x

CVSS3: 9.8

github

около 3 лет назад

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

8.1 High

CVSS3