Vulnerability · Published Dec 20, 2021 · Assigned by apache
CVE-2021-44224Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
High 8.2
In plain English
A high-severity null pointer dereference in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 82.3% (higher than 99.7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.2High
Exploit odds (30 days)82.3%top 0.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-47.module_el8.6.0+2935+fb177b09.2 | ALSA-2022:1915 |
| AlmaLinux:8 | httpd | 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma | ALSA-2022:1915 |
| AlmaLinux:8 | httpd-devel | 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma | ALSA-2022:1915 |
| AlmaLinux:8 | httpd-devel | 2.4.37-47.module_el8.6.0+2935+fb177b09.2 | ALSA-2022:1915 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma | ALSA-2022:1915 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-47.module_el8.6.0+2935+fb177b09.2 | ALSA-2022:1915 |
| AlmaLinux:8 | httpd-manual | 2.4.37-47.module_el8.6.0+2935+fb177b09.2 | ALSA-2022:1915 |
| AlmaLinux:8 | httpd-manual | 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma | ALSA-2022:1915 |
| AlmaLinux:8 | httpd-tools | 2.4.37-47.module_el8.6.0+2935+fb177b09.2 | ALSA-2022:1915 |
| AlmaLinux:8 | httpd-tools | 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma | ALSA-2022:1915 |
| AlmaLinux:8 | mod_http2 | 1.15.7-5.module_el8.6.0+2872+fe0ff7aa | ALSA-2022:1915 |
| AlmaLinux:8 | mod_ldap | 2.4.37-47.module_el8.6.0+2935+fb177b09.2 | ALSA-2022:1915 |
| AlmaLinux:8 | mod_ldap | 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma | ALSA-2022:1915 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2022:1915 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma | ALSA-2022:1915 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-47.module_el8.6.0+2935+fb177b09.2 | ALSA-2022:1915 |
| AlmaLinux:8 | mod_session | 2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma | ALSA-2022:1915 |
| AlmaLinux:8 | mod_session | 2.4.37-47.module_el8.6.0+2935+fb177b09.2 | ALSA-2022:1915 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-47.module_el8.6.0+2935+fb177b09.2 | ALSA-2022:1915 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-47.module_el8.6.0+2872+fe0ff7aa.1.alma | ALSA-2022:1915 |
| Alpine:v3.20 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44224 |
| Alpine:v3.21 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44224 |
| Alpine:v3.22 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44224 |
| Alpine:v3.23 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44224 |
| Alpine:v3.24 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44224 |
| Debian:12 | apache2 | 2.4.52-1 | DEBIAN-CVE-2021-44224 |
| Debian:13 | apache2 | 2.4.52-1 | DEBIAN-CVE-2021-44224 |
| Debian:14 | apache2 | 2.4.52-1 | DEBIAN-CVE-2021-44224 |
| Rocky Linux:8 | httpd | 0:2.4.37-47.module+el8.6.0+823+f143cee1.1 | RLSA-2022:1915 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-5.module+el8.6.0+823+f143cee1 | RLSA-2022:1915 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e | RLSA-2022:1915 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.4.0+553+7a69454b | RLSA-2022:1915 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu1 | UBUNTU-CVE-2021-44224 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.7 – before Apache HTTP Server 2.4* |
Weakness: CWE-476
References
- http://httpd.apache.org/security/vulnerabilities_24.html x_refsource_MISC
- [oss-security] 20211220 CVE-2021-44224: Apache HTTP Server: Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier mailing-list, x_refsource_MLIST
- FEDORA-2021-29a536c2ae vendor-advisory, x_refsource_FEDORA
- DSA-5035 vendor-advisory, x_refsource_DEBIAN
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20211224-0001/ x_refsource_CONFIRM
- https://www.tenable.com/security/tns-2022-01 x_refsource_CONFIRM
- https://www.tenable.com/security/tns-2022-03 x_refsource_CONFIRM
- FEDORA-2022-b4103753e9 vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-21264ec6db vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-78e3211c55 vendor-advisory, x_refsource_FEDORA
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://support.apple.com/kb/HT213257 x_refsource_CONFIRM
- https://support.apple.com/kb/HT213256 x_refsource_CONFIRM
- https://support.apple.com/kb/HT213255 x_refsource_CONFIRM
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina mailing-list, x_refsource_FULLDISC
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6 mailing-list, x_refsource_FULLDISC
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4 mailing-list, x_refsource_FULLDISC
- GLSA-202208-20 vendor-advisory, x_refsource_GENTOO