CVE-2021-44790

critical-risk
Published 2021-12-20

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Do I need to act?

!
86.0% chance of exploitation in next 30 days
EPSS score — higher than 14% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
51193
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Debian Apache Apple Oracle Fedoraproject Netapp Tenable

References (40)

Vendor Advisory http://httpd.apache.org/security/vulnerabilities_24.html
Exploit http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html
Mailing List http://seclists.org/fulldisclosure/2022/May/33
Mailing List http://seclists.org/fulldisclosure/2022/May/35
Mailing List http://seclists.org/fulldisclosure/2022/May/38
Mailing List http://www.openwall.com/lists/oss-security/2021/12/20/4
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202208-20
Third Party Advisory https://security.netapp.com/advisory/ntap-20211224-0001/
Third Party Advisory https://support.apple.com/kb/HT213255
Third Party Advisory https://support.apple.com/kb/HT213256
Third Party Advisory https://support.apple.com/kb/HT213257
Third Party Advisory https://www.debian.org/security/2022/dsa-5035
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujan2022.html
Third Party Advisory https://www.tenable.com/security/tns-2022-01
Third Party Advisory https://www.tenable.com/security/tns-2022-03
and 20 more references
82
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 27/34 · High
Exposure 23/34 · High