BIT-apache-2021-44224

    Dashboard / Vulnerabilities / BIT-apache-2021-44224

    BIT-apache-2021-44224

    Published: 6 Mar 2024Last Modified: 8 Sept 2026

    Summary: Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

    Details: A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

    References: http://httpd.apache.org/security/vulnerabilities_24.html, http://seclists.org/fulldisclosure/2022/May/33, http://seclists.org/fulldisclosure/2022/May/35, http://seclists.org/fulldisclosure/2022/May/38, http://www.openwall.com/lists/oss-security/2021/12/20/3, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/, https://security.gentoo.org/glsa/202208-20, https://security.netapp.com/advisory/ntap-20211224-0001/, https://support.apple.com/kb/HT213255, https://support.apple.com/kb/HT213256, https://support.apple.com/kb/HT213257, https://www.debian.org/security/2022/dsa-5035, https://www.oracle.com/security-alerts/cpuapr2022.html, https://www.oracle.com/security-alerts/cpujan2022.html, https://www.tenable.com/security/tns-2022-01, https://www.tenable.com/security/tns-2022-03, https://nvd.nist.gov/vuln/detail/CVE-2021-44224

    Affected packages

    Package

    Name: apache

    Purl: pkg:bitnami/apache

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 2.4.7
    Fixed -2.4.52

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-apache-2021-44224 | CVE-DB