Published: 20/12/2021 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and previous versions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache http server
fedoraproject fedora 34
fedoraproject fedora 35
fedoraproject fedora 36
debian debian linux 10.0
debian debian linux 11.0
tenable tenable.sc
netapp cloud backup -
oracle http server 12.2.1.3.0
oracle instantis enterprisetrack 17.1
oracle instantis enterprisetrack 17.2
oracle instantis enterprisetrack 17.3
oracle http server 12.2.1.4.0
oracle zfs storage appliance kit 8.8
oracle communications operations monitor 4.3
oracle communications operations monitor 4.4
oracle communications operations monitor 5.0
oracle communications element manager
oracle communications session report manager
oracle communications session route manager
apple macos
apple mac os x 10.15.7

Two vulnerabilities have been discovered in the Apache HTTP server: CVE-2021-44224 When operating as a forward proxy, Apache was depending on the setup suspectible to denial of service or Server Side Request forgery CVE-2021-44790 A buffer overflow in mod_lua may result in denial of service or potentially the execution of arbitrar ...

Synopsis Important: httpd security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for httpd is now available for Red Hat Enterprise Linux 77 Advanced Update Support, Red Hat Enterprise Linux 77 Telco E ...

Synopsis Important: httpd security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for httpd is now available for Red Hat Enterprise Linux 76 Advanced Update Support, Red Hat Enterprise Linux 76 Telco E ...

Synopsis Important: httpd security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for httpd is now available for Red Hat Enterprise Linux 73 Advanced Update SupportRed Hat Product Security has rated th ...

Synopsis Important: httpd:24 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the httpd:24 module is now available for Red Hat Enterprise Linux 81 Update Services for SAP SolutionsRed Hat ...

Synopsis Important: Red Hat OpenShift GitOps security update Type/Severity Security Advisory: Important Topic An update for openshift-gitops-applicationset-container, openshift-gitops-container, openshift-gitops-kam-delivery-container, and openshift-gitops-operator-container is now available for Red Hat OpenShift GitOps 13 on OCP 47-49 (G ...

Synopsis Important: httpd security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for httpd is now available for Red Hat Enterprise Linux 74 Advanced Update SupportRed Hat Product Security has rated th ...

Synopsis Important: httpd24-httpd security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for httpd24-httpd is now available for Red Hat Software CollectionsRed Hat Product Security has rated this updat ...

There's a null pointer dereference and server-side request forgery flaw in httpd's mod_proxy module, when it is configured to be used as a forward proxy A crafted packet could be sent on the adjacent network to the forward proxy that could cause a crash, or potentially SSRF via misdirected Unix Domain Socket requests In the worst case, this could ...

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts) The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one This issue affects Apache HTTP Server 2451 and earlier ...

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security updates page Apple security documents reference vulnerabilities by CVE-ID&nbsp ...

Tenablesc versions 5140 through 5191 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances An attacker would first have to stage a specific file type in the web server root of the Tenablesc host prior to remote exploitation Also, Tenable ...

Tenablesc leverages third-party software to help provide underlying functionality One of the third-party components (Apache) was found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution, and in line with best practice, Tenable has upgraded the bundled components to address the potential imp ...

PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS ...

Critical Infrastructure Sectors: Critical Manufacturing

SnykDesk CLI app that creates Zendesk tickets for Snyk issues based on flags passed in Instructions/Requirements Must have properly scoped Zendesk and Snyk API keys, CLI will prompt for these at run time (Please see references for more info) Populate required variables for Zendesk in configpy Install requirements pip install -r requirementstxt Help python snykdeskpy --

PICKLERICK IP: 101093116 PORTS 22 80 80 apache httpd 2418 comment in webpage : Note to self, remember username! Username: R1ckRul3�s GOBuster dir medium-list /assets DEAD END exploitDB CVE-2021-44790 buffer overflow for webapps v24x DEAD END DIRB -files-common ---- Scanning URL: 101093116/ ----

Thực nghiệm CVE-2021-44790

CVE-2021-44790 Mô tả CVE-2021-44790 CVE-2021-44790 mô tả một lỗi bảo mật cấp độ hệ thống nằm trong mod_lua của Apache HTTP Server, đặc biệt là trong phiên bản 2451 và các phiên bản trước đó Lỗ hổng này được kích hoạt khi hàm r:parsebody() xử lý c

CWE-787 http://httpd.apache.org/security/vulnerabilities_24.html http://www.openwall.com/lists/oss-security/2021/12/20/4 https://security.netapp.com/advisory/ntap-20211224-0001/https://www.debian.org/security/2022/dsa-5035 https://www.tenable.com/security/tns-2022-01 https://www.tenable.com/security/tns-2022-03 https://www.oracle.com/security-alerts/cpujan2022.html https://www.oracle.com/security-alerts/cpuapr2022.html https://support.apple.com/kb/HT213255 https://support.apple.com/kb/HT213256 https://support.apple.com/kb/HT213257 http://seclists.org/fulldisclosure/2022/May/38 http://seclists.org/fulldisclosure/2022/May/33 http://seclists.org/fulldisclosure/2022/May/35 https://security.gentoo.org/glsa/202208-20 http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://nvd.nist.gov https://www.debian.org/security/2022/dsa-5035 https://github.com/nuPacaChi/-CVE-2021-44790 https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-02

Get Started

CVE-2021-44790

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect