CVE-2021-36160

Description

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

How to fix CVE-2021-36160

To remediate CVE-2021-36160, upgrade the affected package to a fixed version below.

• Alpine/apache2—upgrade to 2.4.49-r0 or later
• —upgrade to 2.4.49 or later
• —upgrade to 2.4.51-1~deb11u1 or later
• —no fix listed
• —upgrade to 2.0.14+20161117-3+deb9u4 or later

Is CVE-2021-36160 being exploited?

Likely — EPSS is 62.9%, placing CVE-2021-36160 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (5)

• from 0, < 2.4.49-r0
• >= 2.4.30, < 2.4.49
• from 0, < 2.4.51-1~deb11u1
• from 0
• from 0, < 2.0.14+20161117-3+deb9u4

CVSS scores

References (27)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-36160
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-36160
• WEBhttpd.apache.org/security/vulnerabilities_24.html
• WEBlists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E