Bug 2005117 (CVE-2021-40438)
| Summary: | CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:" | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> | ||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | high | ||||||||
| Version: | unspecified | CC: | 778946088, anon.amish, asoldano, atangrin, bbaranow, bmaxwell, brian.stansberry, caswilli, cdewolf, chazlett, csutherl, darran.lofthouse, dchong, dkreling, dosoudil, eleandro, fjansen, fjuma, gerald.prock, gzaronik, hhorak, iweiss, jclere, jeanbaptiste.dancre, jkaluza, jnakfour, jochrist, jorton, jpallich, jperkins, jwong, jwon, kaycoth, krathod, kwills, lgao, luhliari, msochure, msvehla, mturk, mvanderw, nwallace, pahan, pjindal, pmackay, rguimara, rstancel, rsvoboda, smaestri, szappis, tom.jenkinson, yborgess, ymittal | ||||||
| Target Milestone: | --- | Keywords: | Security | ||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | httpd 2.4.49 | Doc Type: | If docs needed, set a value | ||||||
| Doc Text: |
A Server-Side Request Forgery (SSRF) flaw was found in mod_proxy of httpd. This flaw allows a remote, unauthenticated attacker to make the httpd server forward requests to an arbitrary server. The attacker could get, modify, or delete resources on other services that may be behind a firewall and inaccessible otherwise. The impact of this flaw varies based on what services and resources are available on the httpd network.
|
Story Points: | --- | ||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2021-10-07 14:08:16 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | 2005118, 2007231, 2007232, 2007233, 2007234, 2007235, 2007236, 2007237, 2007238, 2007239, 2009780, 2009781, 2011724, 2011725, 2011726, 2011727, 2011728, 2011729, 2078980, 2078981, 2078982 | ||||||||
| Bug Blocks: | 2005130 | ||||||||
| Attachments: |
|
||||||||
|
Description
Guilherme de Almeida Suckevicz
2021-09-16 20:17:59 UTC
Created httpd tracking bugs for this issue: Affects: fedora-all [bug 2005118] This vulnerability is out of security support scope for the following product: * Red Hat JBoss Enterprise Application Platform 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details. As this issue seems about Unix sockets (UDS), it does not affect the versions of httpd shipped in RHEL 6 and 7 because support for unix: in mod_proxy was added only in upstream versions 2.4.7 and later. RHEL 6 and RHEL 7 ship older versions which do not include the UDS feature. An attacker can use this flaw to perform all kind of HTTP methods, like GET, POST, DELETE, etc. Scope set to Changed (S:C) because this flaw allows to perform requests on other services as if they would come from the httpd server, thus the real impact is to the data and services available elsewhere and not on the httpd server itself. Attack Complexity set to High (AC:H) because an attacker would need to first perform target-specific reconnaissance in order to find out the available services and their endpoints. Upstream patch: https://svn.apache.org/viewvc?view=revision&revision=1893101 In reply to comment #5: > As this issue seems about Unix sockets (UDS), it does not affect the > versions of httpd shipped in RHEL 6 and 7 because support for unix: in > mod_proxy was added only in upstream versions 2.4.7 and later. RHEL 6 and > RHEL 7 ship older versions which do not include the UDS feature. Correction on this: RHEL7 got a backport for the Unix Domain Sockets feature in mod_proxy, thus making it vulnerable to this flaw. This issue has been addressed in the following products: Red Hat JBoss Core Services Via RHSA-2021:3745 https://access.redhat.com/errata/RHSA-2021:3745 This issue has been addressed in the following products: JBoss Core Services on RHEL 7 JBoss Core Services for RHEL 8 Via RHSA-2021:3746 https://access.redhat.com/errata/RHSA-2021:3746 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-40438 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2021:3754 https://access.redhat.com/errata/RHSA-2021:3754 (In reply to Product Security DevOps Team from comment #22) > This bug is now closed. Further updates for individual products will be > reflected on the CVE page(s): > > https://access.redhat.com/security/cve/cve-2021-40438 Why is it closed if it is not (yet) fixed on RHEL7 nor RHEL8 ? This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3816 https://access.redhat.com/errata/RHSA-2021:3816 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2021:3837 https://access.redhat.com/errata/RHSA-2021:3837 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:3836 https://access.redhat.com/errata/RHSA-2021:3836 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Advanced Update Support Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.6 Advanced Update Support Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions Red Hat Enterprise Linux 7.6 Telco Extended Update Support Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 7.7 Advanced Update Support Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions Red Hat Enterprise Linux 7.7 Telco Extended Update Support Red Hat Enterprise Linux 7.2 Advanced Update Support Via RHSA-2021:3856 https://access.redhat.com/errata/RHSA-2021:3856 Created attachment 1859720 [details]
Apache HTTP Server mod_proxy 模块 SSRF漏洞
Created attachment 1859722 [details]
Apache HTTP Server mod_proxy 模块 SSRF漏洞
|