Bug 2005119 (CVE-2021-39275) - CVE-2021-39275 httpd: Out-of-bounds write in ap_escape_quotes() via malicious input
Summary: CVE-2021-39275 httpd: Out-of-bounds write in ap_escape_quotes() via malicious...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-39275
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2005120 2007194 2007195 2007196 2007197 2009780 2009781 2027868 2031074 2057087 2057463 2059257
Blocks: 2005130
TreeView+ depends on / blocked
 
Reported: 2021-09-16 20:22 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-10-26 20:19 UTC (History)
55 users (show)

Fixed In Version: httpd 2.4.49
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds write in function ap_escape_quotes of httpd allows an unauthenticated remote attacker to crash the server or potentially execute code on the system with the privileges of the httpd user, by providing malicious input to the function.
Clone Of:
Environment:
Last Closed: 2022-01-17 10:01:17 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:0170 0 None None None 2022-01-18 19:09:46 UTC
Red Hat Product Errata RHBA-2022:0337 0 None None None 2022-02-01 12:01:53 UTC
Red Hat Product Errata RHSA-2022:0143 0 None None None 2022-01-17 09:01:06 UTC
Red Hat Product Errata RHSA-2022:0891 0 None None None 2022-03-15 10:06:41 UTC
Red Hat Product Errata RHSA-2022:6753 0 None None None 2022-09-29 13:32:14 UTC
Red Hat Product Errata RHSA-2022:7143 0 None None None 2022-10-26 20:19:06 UTC
Red Hat Product Errata RHSA-2022:7144 0 None None None 2022-10-26 20:07:19 UTC

Description Guilherme de Almeida Suckevicz 2021-09-16 20:22:56 UTC 
ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

Reference:
https://httpd.apache.org/security/vulnerabilities_24.html
Comment 1 Guilherme de Almeida Suckevicz 2021-09-16 20:23:17 UTC 
Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 2005120]
Comment 3 Ted Jongseok Won 2021-09-17 04:04:21 UTC 
This vulnerability is out of security support scope for the following product:
 * Red Hat JBoss Enterprise Application Platform 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Comment 12 Chia Cheng Feng 2022-01-14 08:46:35 UTC 
Hi, 
May I know when to fix this in Red Hat JBoss Core Service of fjbcs-httpd24-httpd ?

Thakns

Hunter
Comment 13 errata-xmlrpc 2022-01-17 09:01:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:0143 https://access.redhat.com/errata/RHSA-2022:0143
Comment 14 Product Security DevOps Team 2022-01-17 10:01:12 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-39275
Comment 16 errata-xmlrpc 2022-03-15 10:06:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:0891 https://access.redhat.com/errata/RHSA-2022:0891
Comment 17 Yogendra 2022-04-06 13:13:03 UTC 
May I know when to fix this in Red Hat JBoss Core Service of fjbcs-httpd24-httpd ?
Comment 21 errata-xmlrpc 2022-09-29 13:32:09 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2022:6753 https://access.redhat.com/errata/RHSA-2022:6753
Comment 22 errata-xmlrpc 2022-10-26 20:07:15 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2022:7144 https://access.redhat.com/errata/RHSA-2022:7144
Comment 23 errata-xmlrpc 2022-10-26 20:19:01 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2022:7143 https://access.redhat.com/errata/RHSA-2022:7143
Note You need to log in before you can comment on or make changes to this bug.