CVE-2021-33193

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. Thi...

Summary

Request splitting via HTTP/2 method injection and mod_proxy

Original description

The description as published by the source.

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami apache

[{"type":"SEMVER","events":[{"introduced":"2.4.17"},{"fixed":"2.4.49"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2021-33193 apache2 Fixed in: 2.4.49-r0
Debian DEBIAN-CVE-2021-33193 apache2 Fixed in: 2.4.48-4

References

advisory lists.debian.org
advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory security.gentoo.org
advisory security.netapp.com
advisory tools.cisco.com
advisory tenable.com
patch github.com
patch lists.apache.org
patch lists.apache.org
patch oracle.com
patch oracle.com
report portswigger.net
web nvd.nist.gov