QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-44224

Back to search

CVE-2021-44224

Published: Dec 20, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

VendorProductVersions

Apache Software Foundation

Apache HTTP Server

affected
2.4.7 - < Apache HTTP Server 2.4*

Weaknesses (CWE)

CWE-476

References

FEDORA-2021-29a536c2ae
vendor-advisory
x_refsource_FEDORA
DSA-5035
vendor-advisory
x_refsource_DEBIAN
FEDORA-2022-b4103753e9
vendor-advisory
x_refsource_FEDORA
FEDORA-2022-21264ec6db
vendor-advisory
x_refsource_FEDORA
FEDORA-2022-78e3211c55
vendor-advisory
x_refsource_FEDORA
GLSA-202208-20
vendor-advisory
x_refsource_GENTOO

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now