Hide Forgot
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). References: http://httpd.apache.org/security/vulnerabilities_24.html http://www.openwall.com/lists/oss-security/2021/12/20/3
Created httpd tracking bugs for this issue: Affects: fedora-all [bug 2034673]
Potentially relevant upstream commits: https://svn.apache.org/viewvc?view=revision&revision=1895921 https://svn.apache.org/viewvc?view=revision&revision=1895981 https://svn.apache.org/viewvc?view=revision&revision=r1895955
This vulnerability is out of security support scope for the following product: * Red Hat JBoss Enterprise Application Platform 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:1915 https://access.redhat.com/errata/RHSA-2022:1915
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-44224