cvelist/2021/44xxx/CVE-2021-44790.json

{
    "CVE_data_meta": {
        "ASSIGNER": "security@apache.org",
        "ID": "CVE-2021-44790",
        "STATE": "PUBLIC",
        "TITLE": "Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Apache HTTP Server",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<=",
                                            "version_name": "Apache HTTP Server 2.4",
                                            "version_value": "2.4.51"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "Apache Software Foundation"
                }
            ]
        }
    },
    "credit": [
        {
            "lang": "eng",
            "value": "Chamal"
        },
        {
            "lang": "eng",
            "value": "Anonymous working with Trend Micro Zero Day Initiative"
        }
    ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier."
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.0.9"
    },
    "impact": [
        {
            "other": "high"
        }
    ],
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-787 Out-of-bounds Write"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "refsource": "MISC",
                "url": "http://httpd.apache.org/security/vulnerabilities_24.html",
                "name": "http://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
                "refsource": "MLIST",
                "name": "[oss-security] 20211220 CVE-2021-44790: Apache HTTP Server: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier",
                "url": "http://www.openwall.com/lists/oss-security/2021/12/20/4"
            },
            {
                "refsource": "FEDORA",
                "name": "FEDORA-2021-29a536c2ae",
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/"
            },
            {
                "refsource": "DEBIAN",
                "name": "DSA-5035",
                "url": "https://www.debian.org/security/2022/dsa-5035"
            },
            {
                "url": "https://www.oracle.com/security-alerts/cpujan2022.html",
                "refsource": "MISC",
                "name": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
                "refsource": "CONFIRM",
                "name": "https://security.netapp.com/advisory/ntap-20211224-0001/",
                "url": "https://security.netapp.com/advisory/ntap-20211224-0001/"
            },
            {
                "refsource": "CONFIRM",
                "name": "https://www.tenable.com/security/tns-2022-01",
                "url": "https://www.tenable.com/security/tns-2022-01"
            },
            {
                "refsource": "CONFIRM",
                "name": "https://www.tenable.com/security/tns-2022-03",
                "url": "https://www.tenable.com/security/tns-2022-03"
            },
            {
                "refsource": "FEDORA",
                "name": "FEDORA-2022-b4103753e9",
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/"
            },
            {
                "refsource": "FEDORA",
                "name": "FEDORA-2022-21264ec6db",
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/"
            },
            {
                "refsource": "FEDORA",
                "name": "FEDORA-2022-78e3211c55",
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/"
            },
            {
                "url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
                "refsource": "MISC",
                "name": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
                "refsource": "CONFIRM",
                "name": "https://support.apple.com/kb/HT213257",
                "url": "https://support.apple.com/kb/HT213257"
            },
            {
                "refsource": "CONFIRM",
                "name": "https://support.apple.com/kb/HT213256",
                "url": "https://support.apple.com/kb/HT213256"
            },
            {
                "refsource": "CONFIRM",
                "name": "https://support.apple.com/kb/HT213255",
                "url": "https://support.apple.com/kb/HT213255"
            },
            {
                "refsource": "FULLDISC",
                "name": "20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina",
                "url": "http://seclists.org/fulldisclosure/2022/May/33"
            },
            {
                "refsource": "FULLDISC",
                "name": "20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6",
                "url": "http://seclists.org/fulldisclosure/2022/May/35"
            },
            {
                "refsource": "FULLDISC",
                "name": "20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4",
                "url": "http://seclists.org/fulldisclosure/2022/May/38"
            },
            {
                "refsource": "GENTOO",
                "name": "GLSA-202208-20",
                "url": "https://security.gentoo.org/glsa/202208-20"
            },
            {
                "refsource": "MISC",
                "name": "http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html",
                "url": "http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html"
            }
        ]
    },
    "source": {
        "discovery": "UNKNOWN"
    },
    "timeline": [
        {
            "lang": "eng",
            "time": "2021-12-07",
            "value": "Reported to security team"
        },
        {
            "lang": "eng",
            "time": "2021-12-16",
            "value": "Fixed by r1896039 in 2.4.x"
        }
    ]
}