Vulnerability · Published Dec 20, 2021 · Assigned by apache
CVE-2021-44790Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
Critical 9.8
In plain English
A critical-severity out-of-bounds write in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 96.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)96.8%top 0.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma | ALSA-2022:0258 |
| AlmaLinux:8 | httpd-devel | 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma | ALSA-2022:0258 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma | ALSA-2022:0258 |
| AlmaLinux:8 | httpd-manual | 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma | ALSA-2022:0258 |
| AlmaLinux:8 | httpd-tools | 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma | ALSA-2022:0258 |
| AlmaLinux:8 | mod_http2 | 1.15.7-3.module_el8.5.0+2609+b30d9eec | ALSA-2022:0258 |
| AlmaLinux:8 | mod_ldap | 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma | ALSA-2022:0258 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.5.0+2609+b30d9eec | ALSA-2022:0258 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2022:0258 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma | ALSA-2022:0258 |
| AlmaLinux:8 | mod_session | 2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma | ALSA-2022:0258 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-43.module_el8.5.0+2609+b30d9eec.1.alma | ALSA-2022:0258 |
| Alpine:v3.20 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44790 |
| Alpine:v3.21 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44790 |
| Alpine:v3.22 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44790 |
| Alpine:v3.23 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44790 |
| Alpine:v3.24 | apache2 | 2.4.52-r0 | ALPINE-CVE-2021-44790 |
| Debian:12 | apache2 | 2.4.52-1 | DEBIAN-CVE-2021-44790 |
| Debian:13 | apache2 | 2.4.52-1 | DEBIAN-CVE-2021-44790 |
| Debian:14 | apache2 | 2.4.52-1 | DEBIAN-CVE-2021-44790 |
| Rocky Linux:8 | httpd | 0:2.4.37-43.module+el8.5.0+714+5ec56ee8 | RLSA-2022:0258 |
| Rocky Linux:8 | httpd | 0:2.4.37-39.module+el8.4.0+571+fd70afb1 | RLSA-2022:0258 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-3.module+el8.5.0+695+1fa8055e | RLSA-2022:0258 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-3.module+el8.4.0+553+7a69454b | RLSA-2022:0258 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.4.0+553+7a69454b | RLSA-2022:0258 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e | RLSA-2022:0258 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu1 | UBUNTU-CVE-2021-44790 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | Apache HTTP Server 2.4 – through 2.4.51 |
Weakness: CWE-787
References
- http://httpd.apache.org/security/vulnerabilities_24.html
- [oss-security] 20211220 CVE-2021-44790: Apache HTTP Server: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier mailing-list
- FEDORA-2021-29a536c2ae vendor-advisory
- DSA-5035 vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security.netapp.com/advisory/ntap-20211224-0001/
- https://www.tenable.com/security/tns-2022-01
- https://www.tenable.com/security/tns-2022-03
- FEDORA-2022-b4103753e9 vendor-advisory
- FEDORA-2022-21264ec6db vendor-advisory
- FEDORA-2022-78e3211c55 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://support.apple.com/kb/HT213257
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213255
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina mailing-list
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6 mailing-list
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4 mailing-list
- GLSA-202208-20 vendor-advisory
- http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html