NetSight
IP …
high8.2

CVE-2021-44224

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward…

Impact

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.4.7 before 2.4.52
FedoraprojectFedora
Versions 34, 35, 36
DebianDebian Linux
Versions 10.0, 11.0
TenableTenable.Sc
from 5.14.0 before 5.20.0
from 5.16.0 before 202201.1
OracleCommunications Element Manager
before 9.0
OracleCommunications Operations Monitor
Versions 4.0, 4.3, 4.4, 5.0
OracleCommunications Session Report Manager
before 9.0
OracleCommunications Session Route Manager
before 9.0
OracleHttp Server
All versions
Versions 12.2.1.3.0, 12.2.1.4.0
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3
AppleMac Os X
Version 10.15.7
AppleMacos
before 10.15.7
from 11.0 before 11.6.6
from 12.0.0 before 12.4

Weakness classification

CWE-476

References