CVE-2021-39275: ap_escape_quotes buffer overflow
An out-of-bounds write in function apescapequotes of httpd allows an unauthenticated remote attacker to crash the server or potentially execute code on the system with the privileges of the httpd user, by providing malicious input to the function.
Other sources
apescapequotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.51-28.el8 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.51-28.el7 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 0:2.4.6-97.el7_9.4 - Upgrade
Upgrade
redhat/httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.34-23.el7.5 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.38-3+deb10u8Fixed in 2.4.38-3+deb10u10Fixed in 2.4.56-1~deb11u2Fixed in 2.4.56-1~deb11u1Fixed in 2.4.57-2Fixed in 2.4.57-3Fixed in 2.4.58-1 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.49
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-39275?
CVE-2021-39275 is a vulnerability in the Apache HTTP server that allows an unauthenticated remote attacker to crash the server or potentially execute code with the privileges of the httpd user.
How severe is CVE-2021-39275?
CVE-2021-39275 has a severity rating of 9.8 (Critical) out of 10.
Which software versions are affected by CVE-2021-39275?
CVE-2021-39275 affects Apache HTTP server versions up to and excluding 2.4.49, as well as various other software packages.
How can CVE-2021-39275 be fixed?
To fix CVE-2021-39275, update Apache HTTP server to version 2.4.49 or apply the appropriate security patches provided by the software vendor.
Where can I find more information about CVE-2021-39275?
You can find more information about CVE-2021-39275 on the Apache HTTP server website and the Red Hat Bugzilla.