PT-2021-22928 · Unknown · Ulfius Http Framework

Jeremy Brown · Published 2021-09-07 · Updated 2024-06-15 · CVE-2021-40540

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ulfius HTTP Framework versions prior to 2.7.4

Description The issue arises from the ulfius uri logger in the Ulfius HTTP Framework, which fails to initialize con info and perform a con info->request NULL check for certain malformed HTTP requests. This can lead to remote memory corruption.

Recommendations For versions prior to 2.7.4, update to version 2.7.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the ulfius uri logger function until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2021-40540

OPENSUSE-SU-2024:11481-1

Affected Products

Ulfius Http Framework

References · 14

• 🔥 http://packetstormsecurity.com/files/164152/Ulfius-Web-Framework-Remote-Memory-Corruption.html · Exploit
• https://github.com/babelouest/ulfius/commit/c83f564c184a27145e07c274b305cabe943bbfaa · Patch
• https://github.com/babelouest/ulfius/compare/v2.7.3...v2.7.4 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-40540 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-40540 · Security Note
• https://ubuntu.com/security/CVE-2021-40540 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11481-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-40540 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-40540 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40540 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40540 · Vendor Advisory
• https://t.me/cibsecurity/28307 · Telegram Post
• https://t.me/defcon_news/85060 · Telegram Post
• https://suse.com/security/cve/CVE-2021-40540 · Note