CVE-2021-39275

high-risk

Published 2021-09-16

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

Do I need to act?

37.7% chance of exploitation in next 30 days

EPSS score — higher than 62% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Fix available

Upgrade to: bbacd798d1494b5a99f4e3edab068ccc77b03b7e

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (17)

Http Server

Fedora

Debian Linux

Cloud Backup

Clustered Data Ontap

Storagegrid

Http Server

Instantis Enterprisetrack

Zfs Storage Appliance Kit

Sinec Nms

Sinema Server

Affected Vendors

Debian Apache Oracle Siemens Fedoraproject Netapp

References (30)

Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf

Release Notes https://httpd.apache.org/security/vulnerabilities_24.html

Patch https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a14...

Patch https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156...

Patch https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b318...

Patch https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c...

Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html

Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202208-20

Third Party Advisory https://security.netapp.com/advisory/ntap-20211008-0004/

Third Party Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-a...

Third Party Advisory https://www.debian.org/security/2021/dsa-4982

Patch https://www.oracle.com/security-alerts/cpuapr2022.html

Patch https://www.oracle.com/security-alerts/cpujan2022.html

Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf

Release Notes https://httpd.apache.org/security/vulnerabilities_24.html

Patch https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a14...

Patch https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156...

Patch https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b318...

and 10 more references

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 16/34 · Moderate

Exposure 19/34 · Moderate