PT-2021-3578 · Apache+9 · Apache Http Server+9

Christoph Anton + 4 · Published 2021-04-14 · Updated 2024-03-06 · CVE-2021-30641

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.39 through 2.4.46

Description The issue exists due to insufficient input validation in the Apache HTTP Server. Exploitation of this issue may allow a remote attacker to impact the integrity of protected information. The problem is related to unexpected matching behavior when 'MergeSlashes OFF' is set.

Recommendations For Apache HTTP Server versions 2.4.39 through 2.4.46, update to a version that fixes the unexpected matching behavior with 'MergeSlashes OFF'. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2021:4257

ALT-PU-2021-1838

ALT-PU-2021-2035

ALT-PU-2021-2339

AZL-6478

BDU:2021-03680

BIT-APACHE-2021-30641

CESA-2021_4257

CVE-2021-30641

DLA-2706-1

DSA-4937-1

MGASA-2021-0265

OESA-2021-1246

OPENSUSE-SU-2021:0908-1

OPENSUSE-SU-2021:2127-1

OPENSUSE-SU-2021_0908-1

OPENSUSE-SU-2021_2127-1

RHSA-2021:4257

RHSA-2021:4614

RHSA-2021_4257

RLSA-2021:4257

SUSE-SU-2021:14749-1

SUSE-SU-2021:2004-1

SUSE-SU-2021:2006-1

SUSE-SU-2021:2127-1

SUSE-SU-2021_14749-1

USN-4994-1

USN-4994-2

Affected Products

Alt Linux

Almalinux

Apache Http Server

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 101

• https://advisories.mageia.org/MGASA-2021-0265.html · Security Note
• https://osv.dev/vulnerability/ALSA-2021:4257 · Vendor Advisory
• http://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://debian.org/security/2021/dsa-4937 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-30641 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30641 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4994-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4994-2 · Vendor Advisory
• https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2021-4257.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-30641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35452 · Security Note
• https://osv.dev/vulnerability/RLSA-2021:4257 · Vendor Advisory