CVE-2021-31618

描述

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.

如何修補 CVE-2021-31618

要修補 CVE-2021-31618,請將受影響套件升級到下列已修補版本。

• —升級至 2.4.48-r0 或更新版本
• —升級至 1.15.18 或更新版本
• —升級至 2.4.46-5 或更新版本

CVE-2021-31618 正在被利用嗎?

可能 — EPSS 為 51.2%,屬於高被利用機率區間,建議優先修補。

受影響套件(3)

• from 0, < 2.4.48-r0
• >= 1.15.17, < 1.15.18, >= 2.4.47, < 2.4.48
• from 0, < 2.4.46-5

CVSS 分數

參考連結(16)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-31618
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-31618
• WEBhttpd.apache.org/security/vulnerabilities_24.html
• WEBwww.openwall.com/lists/oss-security/2021/06/10/9
• WEB