httpd:2.4 security update

httpd 2.4.37-43.0.1 - Set vstring per ORACLESUPPORTPRODUCT Orabug: 29892262 - Replace index.html with Oracle's index page oracleindex.html. 2.4.37-43 - Related: 2007235 - CVE-2021-40438 httpd:2.4/httpd: modproxy: SSRF via a crafted request uri-path 2.4.37-42 - Resolves: 2007235 - CVE-2021-40438...

Oracle Linux 8 : httpd:2.4 (ELSA-2021-4537)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4537 advisory. - Related: 2007235 - CVE-2021-40438 httpd:2.4/httpd: modproxy: SSRF via a crafted request uri-path - Resolves: 2007235 - CVE-2021-40438 httpd:2.4/httpd: modprox...

CentOS: Security Advisory for httpd (CESA-2021:3856)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Oracle Linux 8 : httpd:2.4 (ELSA-2021-4257)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4257 advisory. - Add checks on the configured UDS path Orabug: 33412270CVE-2021-40438 - Resolves: 1972500 - CVE-2021-30641 httpd:2.4/httpd: MergeSlashes regression -...

CentOS 7 : httpd (RHSA-2021:3856)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3856 advisory. - A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2021-2746)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2021-2779)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-5219

Name of the Vulnerable Software and Affected Versions Laravel Framework versions through 8.70.2 Description The issue is related to the insufficient blocking of executable PHP content uploads. Specifically, Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, whic...

apache-httpd:fuzz_utils: Heap-buffer-overflow in ap_is_chunked

Detailed Report: https://oss-fuzz.com/testcase?key=5008283178500096 Project: apache-httpd Fuzzing Engine: afl Fuzz Target: fuzzutils Job Type: aflasanapache-httpd Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60900012b31f Crash State: apischunked fuzzutils.c Sanitize...

apache-httpd:fuzz_preq: Heap-buffer-overflow in apreq_header_attribute

Detailed Report: https://oss-fuzz.com/testcase?key=5858262105325568 Project: apache-httpd Fuzzing Engine: libFuzzer Fuzz Target: fuzzpreq Job Type: libfuzzerasanapache-httpd Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x602000000099 Crash State: apreqheaderattribute...

httpd:2.4 security update

httpd 2.4.37-39.0.2.1 - modsession: save one aprstrtok Orabug: 33338149CVE-2021-26690...

RHEL 8 : httpd:2.4 (RHSA-2021:4537)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4537 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Regression of...

RHEL 8 : httpd:2.4 (RHSA-2021:4257)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4257 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: modsession: NULL...

CentOS 8 : httpd:2.4 (CESA-2021:4537)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4537 advisory. - httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat Enterprise Linux 8.5 CVE-2021-20325 Note that Nessus has not tested for this issue but...

CentOS 8 : httpd:2.4 (CESA-2021:4257)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4257 advisory. - httpd: modsession: NULL pointer dereference when parsing Cookie header CVE-2021-26690 - httpd: Unexpected URL matching with 'MergeSlashes OFF'...

httpd: mod_proxy_wstunnel tunneling of non Upgraded connection

A flaw was found in Apache httpd. The modproxywstunnel module tunnels non-upgraded connections...

httpd: mod_session: Heap overflow via a crafted SessionHeader value

A heap overflow flaw was found In Apache httpd modsession. The highest threat from this vulnerability is to system availability...

httpd: NULL pointer dereference via malformed requests

A NULL pointer dereference in httpd allows an unauthenticated remote attacker to crash httpd by providing malformed HTTP requests. The highest threat from this vulnerability is to system availability...

httpd: mod_proxy_wstunnel tunneling of non Upgraded connection

A flaw was found in Apache httpd. The modproxywstunnel module tunnels non-upgraded connections...

2.4 bug fix update

An update is available for httpd, modhttp2, modmd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful,...