PT-2021-4293 · Apache+1 · Apache Http Server+1

Published 2021-10-04 · Updated 2024-03-06 · CVE-2021-41524

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.4.49

Description The issue is related to a null pointer dereference error during HTTP/2 request processing, which can be exploited by an external source to cause a denial of service (DoS) via a specially crafted request. The vulnerability was introduced in version 2.4.49 of the Apache HTTP Server.

Recommendations For Apache HTTP Server version 2.4.49, consider disabling HTTP/2 request processing until a patch is available to prevent potential DoS attacks.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2021-2994

ALT-PU-2021-3018

ALT-PU-2021-3037

ALT-PU-2021-3060

BDU:2021-04902

BIT-APACHE-2021-41524

CVE-2021-41524

MGASA-2021-0461

RHSA-2022:7143

Affected Products

Alt Linux

Apache Http Server

References · 30

• https://nvd.nist.gov/vuln/detail/CVE-2021-41524 · Security Note
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04902 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG · Vendor Advisory
• https://security.gentoo.org/glsa/202208-20 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41524 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-apache-2021-41524 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-41524 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-41524 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41524 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0461 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0461.html · Security Note