This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-44790 →

DEBIAN-CVE-2021-44790

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd...

Original description

The description as published by the source.

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 apache2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1"}]}]

Debian:13 apache2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1"}]}]

Debian:14 apache2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1"}]}]

References

advisory security-tracker.debian.org