Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2021-44224 →

DEBIAN-CVE-2021-44224

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixin...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 apache2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1"}]}]

Debian:13 apache2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1"}]}]

Debian:14 apache2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1"}]}]

Références

advisory security-tracker.debian.org