Описание
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 2.4.29-1ubuntu4.21 |
| devel | released | 2.4.52-1ubuntu1 |
| esm-infra-legacy/trusty | not-affected | 2.4.7-1ubuntu4.22+esm3 |
| esm-infra/bionic | not-affected | 2.4.29-1ubuntu4.21 |
| esm-infra/focal | not-affected | 2.4.41-4ubuntu3.9 |
| esm-infra/xenial | released | 2.4.18-2ubuntu3.17+esm4 |
| focal | released | 2.4.41-4ubuntu3.9 |
| hirsute | released | 2.4.46-4ubuntu1.5 |
| impish | released | 2.4.48-3.1ubuntu3.2 |
| jammy | released | 2.4.52-1ubuntu1 |
Показывать по
EPSS
6.4 Medium
CVSS2
8.2 High
CVSS3
Связанные уязвимости
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
A crafted URI sent to httpd configured as a forward proxy (ProxyReques ...
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
EPSS
6.4 Medium
CVSS2
8.2 High
CVSS3