Home

CVE-2021-44224

Description

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Risk Information

Base Score
8.2
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS Score
Exploitation Probability
10.96

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2021-44224,CVE-2021-44790 are fixed in Apache Apache 2.4.52Windows
Multiple vulnerabilities are fixed in IBM HTTP 9.0.5.11Windows
Multiple vulnerabilities are affected in Oracle HTTP Server 12.2.1.3.0Windows
Multiple vulnerabilities are affected in Oracle HTTP Server 12.2.1.4.0Windows
Multiple vulnerabilities are fixed in Mac OS - Monterey 12.4 (Software Update) - AutoRebootMac
Multiple vulnerabilities are fixed in MacOS Big Sur 11.6.6 - Software UpdateMac
apache2 security update(DSA-5035-1) apache2_2.4.38-3+deb10u7_i386.debLinux
apache2 security update(DSA-5035-1) apache2_2.4.38-3+deb10u7_amd64.debLinux
apache2 security update(DSA-5035-1) apache2_2.4.52-1~deb11u2_amd64.debLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-2.4.51-35.7.1.x86_64.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-debuginfo-2.4.51-35.7.1.x86_64.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-debugsource-2.4.51-35.7.1.x86_64.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-doc-2.4.51-35.7.1.noarch.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-example-pages-2.4.51-35.7.1.x86_64.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-prefork-2.4.51-35.7.1.x86_64.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-prefork-debuginfo-2.4.51-35.7.1.x86_64.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-utils-2.4.51-35.7.1.x86_64.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-utils-debuginfo-2.4.51-35.7.1.x86_64.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-worker-2.4.51-35.7.1.x86_64.rpmLinux
SUSE-SU-2022:0440-1(SUSE Linux Enterprise Server 12-SP5 ) apache2-worker-debuginfo-2.4.51-35.7.1.x86_64.rpmLinux
(RHSA-2022:1915) httpd:2.4 security and bug fix update httpd-debugsource-2.4.37-47.module+el8.6.0+14529+083145da.1.x86_64.rpmLinux
(RHSA-2022:1915) httpd:2.4 security and bug fix update mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpmLinux
(RHSA-2022:1915) httpd:2.4 security and bug fix update mod_ldap-2.4.37-47.module+el8.6.0+14529+083145da.1.x86_64.rpmLinux
(RHSA-2022:1915) httpd:2.4 security and bug fix update mod_proxy_html-2.4.37-47.module+el8.6.0+14529+083145da.1.x86_64.rpmLinux
(RHSA-2022:1915) httpd:2.4 security and bug fix update mod_session-2.4.37-47.module+el8.6.0+14529+083145da.1.x86_64.rpmLinux
Httpd update (ELSA-2023-1670) httpd-2.4.53-7.0.1.el9_1.5.x86_64.rpmLinux
Httpd-core update (ELSA-2023-1670) httpd-core-2.4.53-7.0.1.el9_1.5.x86_64.rpmLinux
Httpd-devel update (ELSA-2023-1670) httpd-devel-2.4.53-7.0.1.el9_1.5.x86_64.rpmLinux
Httpd-filesystem update (ELSA-2023-1670) httpd-filesystem-2.4.53-7.0.1.el9_1.5.noarch.rpmLinux
Httpd-manual update (ELSA-2023-1670) httpd-manual-2.4.53-7.0.1.el9_1.5.noarch.rpmLinux
Httpd-tools update (ELSA-2023-1670) httpd-tools-2.4.53-7.0.1.el9_1.5.x86_64.rpmLinux
Mod_http2 update (ELSA-2023-1670) mod_http2-1.15.19-3.el9_1.5.x86_64.rpmLinux
Mod_ldap update (ELSA-2023-1670) mod_ldap-2.4.53-7.0.1.el9_1.5.x86_64.rpmLinux
Mod_lua update (ELSA-2023-1670) mod_lua-2.4.53-7.0.1.el9_1.5.x86_64.rpmLinux
Mod_proxy_html update (ELSA-2023-1670) mod_proxy_html-2.4.53-7.0.1.el9_1.5.x86_64.rpmLinux
Mod_session update (ELSA-2023-1670) mod_session-2.4.53-7.0.1.el9_1.5.x86_64.rpmLinux
Mod_ssl update (ELSA-2023-1670) mod_ssl-2.4.53-7.0.1.el9_1.5.x86_64.rpmLinux
Vulnerabilities CVE-2021-44224,CVE-2021-44790 are fixed in Apache Apache 2.4.52 (For Linux)Linux
Httpd update (ELSA-2024-3121) httpd-2.4.37-64.module+el8.10.0+90271+3bc76a16.x86_64.rpmLinux
Httpd-devel update (ELSA-2024-3121) httpd-devel-2.4.37-64.module+el8.10.0+90271+3bc76a16.x86_64.rpmLinux
Httpd-filesystem update (ELSA-2024-3121) httpd-filesystem-2.4.37-64.module+el8.10.0+90271+3bc76a16.noarch.rpmLinux
Httpd-manual update (ELSA-2024-3121) httpd-manual-2.4.37-64.module+el8.10.0+90271+3bc76a16.noarch.rpmLinux
Httpd-tools update (ELSA-2024-3121) httpd-tools-2.4.37-64.module+el8.10.0+90271+3bc76a16.x86_64.rpmLinux
Mod_http2 update (ELSA-2024-3121) mod_http2-1.15.7-10.module+el8.10.0+90327+96b8ea28.x86_64.rpmLinux
Mod_ldap update (ELSA-2024-3121) mod_ldap-2.4.37-64.module+el8.10.0+90271+3bc76a16.x86_64.rpmLinux
Mod_md update (ELSA-2024-3121) mod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.x86_64.rpmLinux
Mod_proxy_html update (ELSA-2024-3121) mod_proxy_html-2.4.37-64.module+el8.10.0+90271+3bc76a16.x86_64.rpmLinux
Mod_session update (ELSA-2024-3121) mod_session-2.4.37-64.module+el8.10.0+90271+3bc76a16.x86_64.rpmLinux
Mod_ssl update (ELSA-2024-3121) mod_ssl-2.4.37-64.module+el8.10.0+90271+3bc76a16.x86_64.rpmLinux

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-608134Mac OS - Monterey 12.7.6 (Software Update) - AutoReboot (CVE-2024-27877)
PATCH-605753MacOS Big Sur 11.7.10 - Software Update (Force Reboot)(CVE-2023-41064)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234