CVE-2021-30641: Unexpected URL matching with 'MergeSlashes OFF'

Q: What is CVE-2021-30641?

CVE-2021-30641 is a vulnerability found in Apache HTTP Server versions 2.4.39 to 2.4.46 that causes unexpected matching behavior with MergeSlashes OFF.

Q: What is the severity of CVE-2021-30641?

The severity of CVE-2021-30641 is medium with a severity value of 5.9.

Q: How does CVE-2021-30641 affect data integrity?

CVE-2021-30641 poses a threat to data integrity.

Q: Which software versions are affected by CVE-2021-30641?

Apache HTTP Server versions 2.4.39 to 2.4.46 are affected by CVE-2021-30641.

Q: How can I fix CVE-2021-30641?

To fix CVE-2021-30641, update Apache HTTP Server to version 2.4.47.

Published Jun 1, 2021

Updated

A flaw was found in Apache httpd. A possible regression from an earlier security fix broke behavior of MergeSlashes. The highest threat from this vulnerability is to data integrity.

Other sources

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

Possible regression from security fix broke behavior of MergeSlashes.

References:

https://bz.apache.org/bugzilla/showbug.cgi?id=65238 https://github.com/apache/httpd/commit/eb986059aa5aa0b6c1d52714ea83e3dd758afdd1

— Red Hat

Affected Software

27 affected componentsFixes available

redhat/jbcs-httpd24-apr<0:1.6.3-107.el8

0:1.6.3-107.el8

redhat/jbcs-httpd24-apr-util<0:1.6.1-84.el8

0:1.6.1-84.el8

redhat/jbcs-httpd24-curl<0:7.78.0-2.el8

0:7.78.0-2.el8

redhat/jbcs-httpd24-httpd<0:2.4.37-78.el8

0:2.4.37-78.el8

redhat/jbcs-httpd24-nghttp2<0:1.39.2-39.el8

0:1.39.2-39.el8

redhat/jbcs-httpd24-openssl<1:1.1.1g-8.el8

1:1.1.1g-8.el8

redhat/jbcs-httpd24-openssl-chil<0:1.0.0-7.el8

0:1.0.0-7.el8

redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-22.el8

0:0.4.10-22.el8

redhat/jbcs-httpd24-apr<0:1.6.3-107.jbcs.el7

0:1.6.3-107.jbcs.el7

redhat/jbcs-httpd24-apr-util<0:1.6.1-84.jbcs.el7

0:1.6.1-84.jbcs.el7

redhat/jbcs-httpd24-curl<0:7.78.0-2.jbcs.el7

0:7.78.0-2.jbcs.el7

redhat/jbcs-httpd24-httpd<0:2.4.37-78.jbcs.el7

0:2.4.37-78.jbcs.el7

redhat/jbcs-httpd24-nghttp2<0:1.39.2-39.jbcs.el7

0:1.39.2-39.jbcs.el7

redhat/jbcs-httpd24-openssl<1:1.1.1g-8.jbcs.el7

1:1.1.1g-8.jbcs.el7

redhat/jbcs-httpd24-openssl-chil<0:1.0.0-7.jbcs.el7

0:1.0.0-7.jbcs.el7

redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-22.jbcs.el7

0:0.4.10-22.jbcs.el7

redhat/httpd<2.4.47

2.4.47

Apache HTTP Server>=2.4.39<=2.4.46

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Fedoraproject Fedora=34

Fedoraproject Fedora=35

Oracle Enterprise Manager Ops Center=12.4.0.0

Oracle Instantis Enterprisetrack=17.1

Oracle Instantis Enterprisetrack=17.2

Oracle Instantis Enterprisetrack=17.3

Oracle ZFS Storage Appliance Kit=8.8

Remediation

Information

This issue can be mitigated by setting the "MergeSlashes" directive to OFF

Event History

Jun 1, 2021

Data Sourced

via Red Hat·07:04 PM

DescriptionSeverityAffected Software

Jun 4, 2021

CVE Published

12:00 AM

Jun 10, 2021

CVE Published

via MITRE·07:10 AM

Data Sourced

via MITRE·07:10 AM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2021-30641?

CVE-2021-30641 is a vulnerability found in Apache HTTP Server versions 2.4.39 to 2.4.46 that causes unexpected matching behavior with MergeSlashes OFF.

What is the severity of CVE-2021-30641?