Security Vulnerabilities fixed in httpd RHSA-2022:0143

description-logoDescription

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): httpd: mod_lua: Possible buffer overflow when parsing multipart content (CVE-2021-44790) httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691) httpd: NULL pointer dereference via malformed requests (CVE-2021-34798) httpd: Out-of-bounds write in ap_escape_quotes() via malicious input (CVE-2021-39275) httpd: mod_lua: Possible buffer overflow when parsing multipart content (CVE-2021-44790) httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691) httpd: NULL pointer dereference via malformed requests (CVE-2021-34798) httpd: Out-of-bounds write in ap_escape_quotes() via malicious input (CVE-2021-39275) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. SolutionFor details on how to apply this update, which includes the changes described in this advisory, refer to:https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically.

affected-products-logoAffected Applications

httpd