CVE-2021-44790

Katalog CVE

CVSS 9.8 · Critical EPSS 96,8%

Kerentanan Out-of-bounds Write pada apache http server, fedoraproject fedora +12 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Rincian

Terbit di NVD

20 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

96,8% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://httpd.apache.org/security/vulnerabilities_24.html advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/May/33 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/May/35 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2022/May/38 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/12/20/4 mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7... advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SH... advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBV... advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNW... advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-20 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211224-0001/ advisory pihak ketiga
• https://support.apple.com/kb/HT213255 advisory pihak ketiga
• https://support.apple.com/kb/HT213256 advisory pihak ketiga
• https://support.apple.com/kb/HT213257 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5035 advisory pihak ketiga
• https://www.tenable.com/security/tns-2022-01 advisory pihak ketiga
• https://www.tenable.com/security/tns-2022-03 advisory pihak ketiga
• http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html exploit