Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
25Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 82%
probabilidade de exploração
82%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
O que os fabricantes declaram (VEX)
Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.
Red Hatdocumento VEX ↗
Afetado
1 produto (7 componentes)
Red Hat JBoss Enterprise Application Platform 6
workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Corrigido
6 produtos (149 componentes)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Software Collections for RHEL Workstation(v. 7) · Red Hat JBoss Core Services on RHEL 8 · Red Hat JBoss Core Services on RHEL 7 Server · Red Hat Software Collections for RHEL(v. 7) · e outros 1
Não afetado
5 produtos (156 componentes) — porque o código vulnerável não está presente no produto
Red Hat JBoss Core Services on RHEL 8 · Red Hat JBoss Core Services on RHEL 7 Server · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
Produtos afetados
Apache Software Foundation · Apache HTTP ServerReferências
http://httpd.apache.org/security/vulnerabilities_24.htmlhttp://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211224-0001/https://support.apple.com/kb/HT213255https://support.apple.com/kb/HT213256