NetSight
IP …
critical9.8Public exploit code

CVE-2021-44790

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

Affected products

VendorProductAffected versions
ApacheHttp Server
before 2.4.52
FedoraprojectFedora
Versions 34, 35, 36
DebianDebian Linux
Versions 10.0, 11.0
TenableTenable.Sc
from 5.16.0 before 5.20.0
NetappCloud Backup
All versions
OracleCommunications Element Manager
through 9.0
OracleCommunications Operations Monitor
Versions 4.3, 4.4, 5.0
OracleCommunications Session Report Manager
through 9.0
OracleCommunications Session Route Manager
through 9.0
OracleHttp Server
Versions 12.2.1.3.0, 12.2.1.4.0
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3
OracleZfs Storage Appliance Kit
Version 8.8

Weakness classification

CWE-787

References