CVE-2021-33193
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. Thi...
Résumé
Request splitting via HTTP/2 method injection and mod_proxy
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
Paquets affectés
Bitnami
apache
[{"type":"SEMVER","events":[{"introduced":"2.4.17"},{"fixed":"2.4.49"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2021-33193 apache2 Corrigé dans: 2.4.49-r0
- Debian DEBIAN-CVE-2021-33193 apache2 Corrigé dans: 2.4.48-4
Références
- advisory lists.debian.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory tools.cisco.com
- advisory tenable.com
- patch github.com
- patch lists.apache.org
- patch lists.apache.org
- patch oracle.com
- patch oracle.com
- report portswigger.net
- web nvd.nist.gov