CVE-2021-44790
Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
- State
- Published
- Severity
- Not scored
- Published
- Dec 20, 2021
- Updated
- Aug 4, 2024
- Reserved
- Dec 10, 2021
Description
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
Scores
The record has no CVSS score.
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
Apache HTTP ServerApache Software Foundation |
|
References
- http://httpd.apache.org/security/vulnerabilities_24.html
- [oss-security] 20211220 CVE-2021-44790: Apache HTTP Server: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earliermailing-list
- FEDORA-2021-29a536c2aevendor-advisory
- DSA-5035vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security.netapp.com/advisory/ntap-20211224-0001/
- https://www.tenable.com/security/tns-2022-01
- https://www.tenable.com/security/tns-2022-03
- FEDORA-2022-b4103753e9vendor-advisory
- FEDORA-2022-21264ec6dbvendor-advisory
- FEDORA-2022-78e3211c55vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://support.apple.com/kb/HT213257
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213255
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalinamailing-list
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6mailing-list
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4mailing-list
- GLSA-202208-20vendor-advisory
- http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.