A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-httpdalma-upgrade-httpd-develalma-upgrade-httpd-filesystemalma-upgrade-httpd-manualalma-upgrade-httpd-toolsalma-upgrade-mod_http2alma-upgrade-mod_ldapalma-upgrade-mod_mdalma-upgrade-mod_proxy_htmlalma-upgrade-mod_sessionalma-upgrade-mod_ssl | May 13, 2022 | Dec 20, 2021 | |
| Alpine Linux | alpine-linux-upgrade-apache2 | Aug 22, 2024 | Dec 20, 2021 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-httpdamazon-linux-ami-2-upgrade-httpd-debuginfoamazon-linux-ami-2-upgrade-httpd-develamazon-linux-ami-2-upgrade-httpd-filesystemamazon-linux-ami-2-upgrade-httpd-manualamazon-linux-ami-2-upgrade-httpd-toolsamazon-linux-ami-2-upgrade-mod_ldapamazon-linux-ami-2-upgrade-mod_mdamazon-linux-ami-2-upgrade-mod_proxy_htmlamazon-linux-ami-2-upgrade-mod_sessionamazon-linux-ami-2-upgrade-mod_ssl | Jul 4, 2022 | Dec 20, 2021 | |
| Amazon_linux | — | amazon-linux-upgrade-httpd24 | Jan 20, 2022 | Dec 20, 2021 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-httpdamazon-linux-2023-upgrade-httpd-coreamazon-linux-2023-upgrade-httpd-core-debuginfoamazon-linux-2023-upgrade-httpd-debuginfoamazon-linux-2023-upgrade-httpd-debugsourceamazon-linux-2023-upgrade-httpd-develamazon-linux-2023-upgrade-httpd-filesystemamazon-linux-2023-upgrade-httpd-manualamazon-linux-2023-upgrade-httpd-toolsamazon-linux-2023-upgrade-httpd-tools-debuginfoamazon-linux-2023-upgrade-mod-ldapamazon-linux-2023-upgrade-mod-ldap-debuginfoamazon-linux-2023-upgrade-mod-luaamazon-linux-2023-upgrade-mod-lua-debuginfoamazon-linux-2023-upgrade-mod-proxy-htmlamazon-linux-2023-upgrade-mod-proxy-html-debuginfoamazon-linux-2023-upgrade-mod-sessionamazon-linux-2023-upgrade-mod-session-debuginfoamazon-linux-2023-upgrade-mod-sslamazon-linux-2023-upgrade-mod-ssl-debuginfo | Feb 17, 2025 | Dec 20, 2021 | |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Jan 6, 2022 | Dec 20, 2021 |
| Apple Osx Apache | apple-osx-security-update-2022-004-catalinaapple-osx-upgrade-latest | May 17, 2022 | Dec 20, 2021 | |
| Centos_linux | — | centos-upgrade-httpdcentos-upgrade-httpd-debuginfocentos-upgrade-httpd-debugsourcecentos-upgrade-httpd-develcentos-upgrade-httpd-filesystemcentos-upgrade-httpd-manualcentos-upgrade-httpd-toolscentos-upgrade-httpd-tools-debuginfocentos-upgrade-mod_http2centos-upgrade-mod_http2-debuginfocentos-upgrade-mod_http2-debugsourcecentos-upgrade-mod_ldapcentos-upgrade-mod_ldap-debuginfocentos-upgrade-mod_mdcentos-upgrade-mod_md-debuginfocentos-upgrade-mod_md-debugsourcecentos-upgrade-mod_proxy_htmlcentos-upgrade-mod_proxy_html-debuginfocentos-upgrade-mod_sessioncentos-upgrade-mod_session-debuginfocentos-upgrade-mod_sslcentos-upgrade-mod_ssl-debuginfo | May 13, 2022 | Dec 20, 2021 |
| Debian | debian-upgrade-apache2 | Jan 6, 2022 | Dec 20, 2021 | |
| Freebsd | freebsd-upgrade-package-apache24 | Nov 4, 2022 | Dec 20, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-app-admin-apache-toolsgentoo-linux-upgrade-www-servers-apache | Aug 16, 2022 | Dec 20, 2021 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-httpdhuawei-euleros-2_0_sp10-upgrade-httpd-filesystemhuawei-euleros-2_0_sp10-upgrade-httpd-toolshuawei-euleros-2_0_sp10-upgrade-mod_ssl | Apr 20, 2022 | Dec 20, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-httpdhuawei-euleros-2_0_sp8-upgrade-httpd-develhuawei-euleros-2_0_sp8-upgrade-httpd-filesystemhuawei-euleros-2_0_sp8-upgrade-httpd-manualhuawei-euleros-2_0_sp8-upgrade-httpd-toolshuawei-euleros-2_0_sp8-upgrade-mod_sessionhuawei-euleros-2_0_sp8-upgrade-mod_ssl | Mar 29, 2022 | Dec 20, 2021 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-httpdhuawei-euleros-2_0_sp9-upgrade-httpd-filesystemhuawei-euleros-2_0_sp9-upgrade-httpd-toolshuawei-euleros-2_0_sp9-upgrade-mod_ssl | Mar 3, 2022 | Dec 20, 2021 | |
| Ibm Http_server | ibm-http_server-apply-interim-fix-interim-fix-pm46234-for-6_1ibm-http_server-apply-interim-fix-interim-fix-pm46234-for-7_0ibm-http_server-apply-interim-fix-pi27904-for-7_0ibm-http_server-apply-interim-fix-interim-fix-pm46234-for-8_0ibm-http_server-apply-interim-fix-pi27904-for-8_0ibm-http_server-apply-interim-fix-pi27904-for-8_5ibm-http_server-apply-interim-fix-ph42862-for-9_0ibm-http_server-apply-interim-fix-interim-fix-ph67414-for-9_0ibm-http_server-apply-fix-pack-6_1_0_41ibm-http_server-apply-fix-pack-7_0_0_21ibm-http_server-apply-fix-pack-7_0_0_37ibm-http_server-apply-fix-pack-8_0_0_1ibm-http_server-apply-fix-pack-8_0_0_10ibm-http_server-apply-fix-pack-8_5_5_4ibm-http_server-apply-fix-pack-9_0_0_3ibm-http_server-apply-fix-pack-9_0_5_11ibm-http_server-apply-fix-pack-9_0_5_25 | Aug 31, 2022 | Jan 12, 2022 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-web-server-apache-24-2-4-52-11-4-42-0-1-113-1oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-dbd-2-4-52-11-4-42-0-1-113-1oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-gss-2-4-52-11-4-42-0-1-113-1oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ldap-2-4-52-11-4-42-0-1-113-1oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-lua-2-4-52-11-4-42-0-1-113-1oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-2-4-52-11-4-42-0-1-113-1oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-52-11-4-42-0-1-113-1 | Feb 17, 2022 | Dec 20, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-httpdoracle-linux-upgrade-httpd-develoracle-linux-upgrade-httpd-filesystemoracle-linux-upgrade-httpd-manualoracle-linux-upgrade-httpd-toolsoracle-linux-upgrade-mod-http2oracle-linux-upgrade-mod-ldaporacle-linux-upgrade-mod-mdoracle-linux-upgrade-mod-proxy-htmloracle-linux-upgrade-mod-sessionoracle-linux-upgrade-mod-ssl | May 18, 2022 | Dec 20, 2021 |
| Redhat_linux | redhat-upgrade-httpdredhat-upgrade-httpd-debuginforedhat-upgrade-httpd-debugsourceredhat-upgrade-httpd-develredhat-upgrade-httpd-filesystemredhat-upgrade-httpd-manualredhat-upgrade-httpd-toolsredhat-upgrade-httpd-tools-debuginforedhat-upgrade-mod_http2redhat-upgrade-mod_http2-debuginforedhat-upgrade-mod_http2-debugsourceredhat-upgrade-mod_ldapredhat-upgrade-mod_ldap-debuginforedhat-upgrade-mod_mdredhat-upgrade-mod_md-debuginforedhat-upgrade-mod_md-debugsourceredhat-upgrade-mod_proxy_htmlredhat-upgrade-mod_proxy_html-debuginforedhat-upgrade-mod_sessionredhat-upgrade-mod_session-debuginforedhat-upgrade-mod_sslredhat-upgrade-mod_ssl-debuginfo | May 13, 2022 | Dec 20, 2021 | |
| Rocky_linux | rocky-upgrade-httpdrocky-upgrade-httpd-debuginforocky-upgrade-httpd-debugsourcerocky-upgrade-httpd-develrocky-upgrade-httpd-toolsrocky-upgrade-httpd-tools-debuginforocky-upgrade-mod_http2rocky-upgrade-mod_http2-debuginforocky-upgrade-mod_http2-debugsourcerocky-upgrade-mod_ldaprocky-upgrade-mod_ldap-debuginforocky-upgrade-mod_mdrocky-upgrade-mod_md-debuginforocky-upgrade-mod_md-debugsourcerocky-upgrade-mod_proxy_htmlrocky-upgrade-mod_proxy_html-debuginforocky-upgrade-mod_sessionrocky-upgrade-mod_session-debuginforocky-upgrade-mod_sslrocky-upgrade-mod_ssl-debuginfo | Mar 5, 2024 | Dec 20, 2021 | |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-eventsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Jan 13, 2022 | Dec 20, 2021 |
| Ubuntu | ubuntu-pro-upgrade-apache2ubuntu-pro-upgrade-apache2-binubuntu-upgrade-apache2ubuntu-upgrade-apache2-bin | Jan 7, 2022 | Dec 20, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub