CVE-2021-40438

01/תיאור (מקור, אנגלית)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

02/מוצרים מושפעים

resf: rocky linux; redhat: enterprise linux; redhat: enterprise linux eus; redhat: enterprise linux for arm 64; redhat: enterprise linux for arm 64 eus; redhat: enterprise linux for ibm z systems; redhat: enterprise linux for ibm z systems eus; redhat: enterprise linux for ibm z systems eus s390x; redhat: enterprise linux for power big endian; redhat: enterprise linux for power little endian; redhat: enterprise linux for power little endian eus; redhat: enterprise linux for scientific computing; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux server for power little endian update services for sap solutions

03/קישורים10

• httpd.apache.org/security/vulnerabilities_24.html Release NotesVendor Advisory
• httpd.apache.org/security/vulnerabilities_24.html Release NotesVendor Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
• cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf Third Party Advisory
• lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4d‮… Mailing List
• lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c5‮… Mailing List
• lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d7530‮… Mailing List