csaf_suse - suse-su-2021:2127-1

suse-su-2021:2127-1

Vulnerability from csaf_suse

Published

2021-06-22 14:41

Modified

2021-06-22 14:41

Summary

Security update for apache2

Notes

Title of the patch

Security update for apache2

Description of the patch

This update for apache2 fixes the following issues: - fixed CVE-2021-30641 [bsc#1187174]: MergeSlashes regression - fixed CVE-2021-31618 [bsc#1186924]: NULL pointer dereference on specially crafted HTTP/2 request - fixed CVE-2020-13950 [bsc#1187040]: mod_proxy NULL pointer dereference - fixed CVE-2020-35452 [bsc#1186922]: Single zero byte stack overflow in mod_auth_digest - fixed CVE-2021-26690 [bsc#1186923]: mod_session NULL pointer dereference in parser - fixed CVE-2021-26691 [bsc#1187017]: Heap overflow in mod_session

Patchnames

SUSE-2021-2127,SUSE-SLE-Module-Basesystem-15-SP2-2021-2127,SUSE-SLE-Module-Basesystem-15-SP3-2021-2127,SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2021-2127,SUSE-SLE-Module-Server-Applications-15-SP2-2021-2127,SUSE-SLE-Module-Server-Applications-15-SP3-2021-2127

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for apache2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for apache2 fixes the following issues:\n\n- fixed CVE-2021-30641 [bsc#1187174]: MergeSlashes regression\n- fixed CVE-2021-31618 [bsc#1186924]: NULL pointer dereference on specially crafted HTTP/2 request\n- fixed CVE-2020-13950 [bsc#1187040]: mod_proxy NULL pointer dereference\n- fixed CVE-2020-35452 [bsc#1186922]: Single zero byte stack overflow in mod_auth_digest \n- fixed CVE-2021-26690 [bsc#1186923]: mod_session NULL pointer dereference in parser\n- fixed CVE-2021-26691 [bsc#1187017]: Heap overflow in mod_session\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2021-2127,SUSE-SLE-Module-Basesystem-15-SP2-2021-2127,SUSE-SLE-Module-Basesystem-15-SP3-2021-2127,SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2021-2127,SUSE-SLE-Module-Server-Applications-15-SP2-2021-2127,SUSE-SLE-Module-Server-Applications-15-SP3-2021-2127",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_2127-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2021:2127-1",
        "url": "https://www.suse.com/support/update/announcement/2021/suse-su-20212127-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2021:2127-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-June/009074.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1186922",
        "url": "https://bugzilla.suse.com/1186922"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1186923",
        "url": "https://bugzilla.suse.com/1186923"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1186924",
        "url": "https://bugzilla.suse.com/1186924"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187017",
        "url": "https://bugzilla.suse.com/1187017"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187040",
        "url": "https://bugzilla.suse.com/1187040"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187174",
        "url": "https://bugzilla.suse.com/1187174"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-13950 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-13950/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-35452 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-35452/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-26690 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-26690/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-26691 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-26691/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-30641 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-30641/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-31618 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-31618/"
      }
    ],
    "title": "Security update for apache2",
    "tracking": {
      "current_release_date": "2021-06-22T14:41:02Z",
      "generator": {
        "date": "2021-06-22T14:41:02Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2021:2127-1",
      "initial_release_date": "2021-06-22T14:41:02Z",
      "revision_history": [
        {
          "date": "2021-06-22T14:41:02Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-2.4.43-3.22.1.aarch64",
                "product": {
                  "name": "apache2-2.4.43-3.22.1.aarch64",
                  "product_id": "apache2-2.4.43-3.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-devel-2.4.43-3.22.1.aarch64",
                "product": {
                  "name": "apache2-devel-2.4.43-3.22.1.aarch64",
                  "product_id": "apache2-devel-2.4.43-3.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-event-2.4.43-3.22.1.aarch64",
                "product": {
                  "name": "apache2-event-2.4.43-3.22.1.aarch64",
                  "product_id": "apache2-event-2.4.43-3.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-example-pages-2.4.43-3.22.1.aarch64",
                "product": {
                  "name": "apache2-example-pages-2.4.43-3.22.1.aarch64",
                  "product_id": "apache2-example-pages-2.4.43-3.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-prefork-2.4.43-3.22.1.aarch64",
                "product": {
                  "name": "apache2-prefork-2.4.43-3.22.1.aarch64",
                  "product_id": "apache2-prefork-2.4.43-3.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-utils-2.4.43-3.22.1.aarch64",
                "product": {
                  "name": "apache2-utils-2.4.43-3.22.1.aarch64",
                  "product_id": "apache2-utils-2.4.43-3.22.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-worker-2.4.43-3.22.1.aarch64",
                "product": {
                  "name": "apache2-worker-2.4.43-3.22.1.aarch64",
                  "product_id": "apache2-worker-2.4.43-3.22.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-2.4.43-3.22.1.i586",
                "product": {
                  "name": "apache2-2.4.43-3.22.1.i586",
                  "product_id": "apache2-2.4.43-3.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-devel-2.4.43-3.22.1.i586",
                "product": {
                  "name": "apache2-devel-2.4.43-3.22.1.i586",
                  "product_id": "apache2-devel-2.4.43-3.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-event-2.4.43-3.22.1.i586",
                "product": {
                  "name": "apache2-event-2.4.43-3.22.1.i586",
                  "product_id": "apache2-event-2.4.43-3.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-example-pages-2.4.43-3.22.1.i586",
                "product": {
                  "name": "apache2-example-pages-2.4.43-3.22.1.i586",
                  "product_id": "apache2-example-pages-2.4.43-3.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-prefork-2.4.43-3.22.1.i586",
                "product": {
                  "name": "apache2-prefork-2.4.43-3.22.1.i586",
                  "product_id": "apache2-prefork-2.4.43-3.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-utils-2.4.43-3.22.1.i586",
                "product": {
                  "name": "apache2-utils-2.4.43-3.22.1.i586",
                  "product_id": "apache2-utils-2.4.43-3.22.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-worker-2.4.43-3.22.1.i586",
                "product": {
                  "name": "apache2-worker-2.4.43-3.22.1.i586",
                  "product_id": "apache2-worker-2.4.43-3.22.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-doc-2.4.43-3.22.1.noarch",
                "product": {
                  "name": "apache2-doc-2.4.43-3.22.1.noarch",
                  "product_id": "apache2-doc-2.4.43-3.22.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-2.4.43-3.22.1.ppc64le",
                "product": {
                  "name": "apache2-2.4.43-3.22.1.ppc64le",
                  "product_id": "apache2-2.4.43-3.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-devel-2.4.43-3.22.1.ppc64le",
                "product": {
                  "name": "apache2-devel-2.4.43-3.22.1.ppc64le",
                  "product_id": "apache2-devel-2.4.43-3.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-event-2.4.43-3.22.1.ppc64le",
                "product": {
                  "name": "apache2-event-2.4.43-3.22.1.ppc64le",
                  "product_id": "apache2-event-2.4.43-3.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-example-pages-2.4.43-3.22.1.ppc64le",
                "product": {
                  "name": "apache2-example-pages-2.4.43-3.22.1.ppc64le",
                  "product_id": "apache2-example-pages-2.4.43-3.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-prefork-2.4.43-3.22.1.ppc64le",
                "product": {
                  "name": "apache2-prefork-2.4.43-3.22.1.ppc64le",
                  "product_id": "apache2-prefork-2.4.43-3.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-utils-2.4.43-3.22.1.ppc64le",
                "product": {
                  "name": "apache2-utils-2.4.43-3.22.1.ppc64le",
                  "product_id": "apache2-utils-2.4.43-3.22.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-worker-2.4.43-3.22.1.ppc64le",
                "product": {
                  "name": "apache2-worker-2.4.43-3.22.1.ppc64le",
                  "product_id": "apache2-worker-2.4.43-3.22.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-2.4.43-3.22.1.s390x",
                "product": {
                  "name": "apache2-2.4.43-3.22.1.s390x",
                  "product_id": "apache2-2.4.43-3.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-devel-2.4.43-3.22.1.s390x",
                "product": {
                  "name": "apache2-devel-2.4.43-3.22.1.s390x",
                  "product_id": "apache2-devel-2.4.43-3.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-event-2.4.43-3.22.1.s390x",
                "product": {
                  "name": "apache2-event-2.4.43-3.22.1.s390x",
                  "product_id": "apache2-event-2.4.43-3.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-example-pages-2.4.43-3.22.1.s390x",
                "product": {
                  "name": "apache2-example-pages-2.4.43-3.22.1.s390x",
                  "product_id": "apache2-example-pages-2.4.43-3.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-prefork-2.4.43-3.22.1.s390x",
                "product": {
                  "name": "apache2-prefork-2.4.43-3.22.1.s390x",
                  "product_id": "apache2-prefork-2.4.43-3.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-utils-2.4.43-3.22.1.s390x",
                "product": {
                  "name": "apache2-utils-2.4.43-3.22.1.s390x",
                  "product_id": "apache2-utils-2.4.43-3.22.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-worker-2.4.43-3.22.1.s390x",
                "product": {
                  "name": "apache2-worker-2.4.43-3.22.1.s390x",
                  "product_id": "apache2-worker-2.4.43-3.22.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-2.4.43-3.22.1.x86_64",
                "product": {
                  "name": "apache2-2.4.43-3.22.1.x86_64",
                  "product_id": "apache2-2.4.43-3.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-devel-2.4.43-3.22.1.x86_64",
                "product": {
                  "name": "apache2-devel-2.4.43-3.22.1.x86_64",
                  "product_id": "apache2-devel-2.4.43-3.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-event-2.4.43-3.22.1.x86_64",
                "product": {
                  "name": "apache2-event-2.4.43-3.22.1.x86_64",
                  "product_id": "apache2-event-2.4.43-3.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-example-pages-2.4.43-3.22.1.x86_64",
                "product": {
                  "name": "apache2-example-pages-2.4.43-3.22.1.x86_64",
                  "product_id": "apache2-example-pages-2.4.43-3.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-prefork-2.4.43-3.22.1.x86_64",
                "product": {
                  "name": "apache2-prefork-2.4.43-3.22.1.x86_64",
                  "product_id": "apache2-prefork-2.4.43-3.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-utils-2.4.43-3.22.1.x86_64",
                "product": {
                  "name": "apache2-utils-2.4.43-3.22.1.x86_64",
                  "product_id": "apache2-utils-2.4.43-3.22.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apache2-worker-2.4.43-3.22.1.x86_64",
                "product": {
                  "name": "apache2-worker-2.4.43-3.22.1.x86_64",
                  "product_id": "apache2-worker-2.4.43-3.22.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP2",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Basesystem 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Basesystem 15 SP3",
                  "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-basesystem:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP3",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Server Applications 15 SP2",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Server Applications 15 SP2",
                  "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-server-applications:15:sp2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Server Applications 15 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Server Applications 15 SP3",
                  "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-server-applications:15:sp3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-prefork-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-prefork-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-prefork-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-prefork-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-prefork-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-prefork-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-prefork-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-prefork-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-utils-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-utils-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-utils-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-utils-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-utils-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-utils-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-utils-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-utils-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-prefork-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-prefork-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-prefork-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-prefork-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-prefork-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-prefork-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-prefork-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-prefork-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-utils-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-utils-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-utils-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-utils-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-utils-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-utils-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-utils-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-utils-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-event-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-event-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-event-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-event-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-event-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-event-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-event-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-event-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-devel-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-devel-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-devel-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-devel-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-devel-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-devel-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-devel-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-devel-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-doc-2.4.43-3.22.1.noarch as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch"
        },
        "product_reference": "apache2-doc-2.4.43-3.22.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-worker-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-worker-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-worker-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-worker-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-worker-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-worker-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-worker-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP2",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-worker-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-devel-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-devel-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-devel-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-devel-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-devel-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-devel-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-devel-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-devel-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-doc-2.4.43-3.22.1.noarch as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch"
        },
        "product_reference": "apache2-doc-2.4.43-3.22.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-worker-2.4.43-3.22.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64"
        },
        "product_reference": "apache2-worker-2.4.43-3.22.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-worker-2.4.43-3.22.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le"
        },
        "product_reference": "apache2-worker-2.4.43-3.22.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-worker-2.4.43-3.22.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x"
        },
        "product_reference": "apache2-worker-2.4.43-3.22.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-worker-2.4.43-3.22.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP3",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
        },
        "product_reference": "apache2-worker-2.4.43-3.22.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-13950",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-13950"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-13950",
          "url": "https://www.suse.com/security/cve/CVE-2020-13950"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187040 for CVE-2020-13950",
          "url": "https://bugzilla.suse.com/1187040"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-06-22T14:41:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-13950"
    },
    {
      "cve": "CVE-2020-35452",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-35452"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-35452",
          "url": "https://www.suse.com/security/cve/CVE-2020-35452"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1186922 for CVE-2020-35452",
          "url": "https://bugzilla.suse.com/1186922"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187933 for CVE-2020-35452",
          "url": "https://bugzilla.suse.com/1187933"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-06-22T14:41:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-35452"
    },
    {
      "cve": "CVE-2021-26690",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-26690"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-26690",
          "url": "https://www.suse.com/security/cve/CVE-2021-26690"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1186923 for CVE-2021-26690",
          "url": "https://bugzilla.suse.com/1186923"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187933 for CVE-2021-26690",
          "url": "https://bugzilla.suse.com/1187933"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-06-22T14:41:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-26690"
    },
    {
      "cve": "CVE-2021-26691",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-26691"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-26691",
          "url": "https://www.suse.com/security/cve/CVE-2021-26691"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187017 for CVE-2021-26691",
          "url": "https://bugzilla.suse.com/1187017"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187933 for CVE-2021-26691",
          "url": "https://bugzilla.suse.com/1187933"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-06-22T14:41:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-26691"
    },
    {
      "cve": "CVE-2021-30641",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-30641"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with \u0027MergeSlashes OFF\u0027",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-30641",
          "url": "https://www.suse.com/security/cve/CVE-2021-30641"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187174 for CVE-2021-30641",
          "url": "https://bugzilla.suse.com/1187174"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-06-22T14:41:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-30641"
    },
    {
      "cve": "CVE-2021-31618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-31618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-31618",
          "url": "https://www.suse.com/security/cve/CVE-2021-31618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1186924 for CVE-2021-31618",
          "url": "https://bugzilla.suse.com/1186924"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187933 for CVE-2021-31618",
          "url": "https://bugzilla.suse.com/1187933"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP2:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-prefork-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Basesystem 15 SP3:apache2-utils-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP3:apache2-event-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-worker-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-devel-2.4.43-3.22.1.x86_64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-doc-2.4.43-3.22.1.noarch",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-worker-2.4.43-3.22.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-06-22T14:41:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-31618"
    }
  ]
}

CVE-2021-26690 (GCVE-0-2021-26690)

Vulnerability from cvelistv5

Published

2021-06-10 07:10

Modified

2024-08-03 20:33

Severity ?

CWE

mod_session NULL pointer dereference

Summary

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

References

URL

Tags

	http://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_MISC
	https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/rae406c1d19c0dfd3103c96923dadac2af1cd0bad6905ab1ede153865%40%3Cannounce.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2021/06/10/6	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2021/dsa-4937	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/202107-38	vendor-advisory, x_refsource_GENTOO
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210702-0001/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: 2.4.46 Version: 2.4.43 Version: 2.4.41 Version: 2.4.39 Version: 2.4.38 Version: 2.4.37 Version: 2.4.35 Version: 2.4.34 Version: 2.4.33 Version: 2.4.29 Version: 2.4.28 Version: 2.4.27 Version: 2.4.26 Version: 2.4.25 Version: 2.4.23 Version: 2.4.20 Version: 2.4.18 Version: 2.4.17 Version: 2.4.16 Version: 2.4.12 Version: 2.4.10 Version: 2.4.9 Version: 2.4.7 Version: 2.4.6 Version: 2.4.4 Version: 2.4.3 Version: 2.4.2 Version: 2.4.1 Version: 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:33:40.192Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-announce] 20210609 CVE-2021-26690: mod_session NULL pointer dereference",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rae406c1d19c0dfd3103c96923dadac2af1cd0bad6905ab1ede153865%40%3Cannounce.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210609 CVE-2021-26690: Apache httpd: mod_session NULL pointer dereference",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/06/10/6"
          },
          {
            "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
          },
          {
            "name": "DSA-4937",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4937"
          },
          {
            "name": "GLSA-202107-38",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-38"
          },
          {
            "name": "FEDORA-2021-dce7e7738e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
          },
          {
            "name": "FEDORA-2021-e3f6dd670d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.46"
            },
            {
              "status": "affected",
              "version": "2.4.43"
            },
            {
              "status": "affected",
              "version": "2.4.41"
            },
            {
              "status": "affected",
              "version": "2.4.39"
            },
            {
              "status": "affected",
              "version": "2.4.38"
            },
            {
              "status": "affected",
              "version": "2.4.37"
            },
            {
              "status": "affected",
              "version": "2.4.35"
            },
            {
              "status": "affected",
              "version": "2.4.34"
            },
            {
              "status": "affected",
              "version": "2.4.33"
            },
            {
              "status": "affected",
              "version": "2.4.29"
            },
            {
              "status": "affected",
              "version": "2.4.28"
            },
            {
              "status": "affected",
              "version": "2.4.27"
            },
            {
              "status": "affected",
              "version": "2.4.26"
            },
            {
              "status": "affected",
              "version": "2.4.25"
            },
            {
              "status": "affected",
              "version": "2.4.23"
            },
            {
              "status": "affected",
              "version": "2.4.20"
            },
            {
              "status": "affected",
              "version": "2.4.18"
            },
            {
              "status": "affected",
              "version": "2.4.17"
            },
            {
              "status": "affected",
              "version": "2.4.16"
            },
            {
              "status": "affected",
              "version": "2.4.12"
            },
            {
              "status": "affected",
              "version": "2.4.10"
            },
            {
              "status": "affected",
              "version": "2.4.9"
            },
            {
              "status": "affected",
              "version": "2.4.7"
            },
            {
              "status": "affected",
              "version": "2.4.6"
            },
            {
              "status": "affected",
              "version": "2.4.4"
            },
            {
              "status": "affected",
              "version": "2.4.3"
            },
            {
              "status": "affected",
              "version": "2.4.2"
            },
            {
              "status": "affected",
              "version": "2.4.1"
            },
            {
              "status": "affected",
              "version": "2.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered and reported by GHSL team member @antonio-morales (Antonio Morales)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "low"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "mod_session NULL pointer dereference",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:41:43",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-announce] 20210609 CVE-2021-26690: mod_session NULL pointer dereference",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rae406c1d19c0dfd3103c96923dadac2af1cd0bad6905ab1ede153865%40%3Cannounce.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210609 CVE-2021-26690: Apache httpd: mod_session NULL pointer dereference",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/06/10/6"
        },
        {
          "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
        },
        {
          "name": "DSA-4937",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4937"
        },
        {
          "name": "GLSA-202107-38",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-38"
        },
        {
          "name": "FEDORA-2021-dce7e7738e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
        },
        {
          "name": "FEDORA-2021-e3f6dd670d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "mod_session NULL pointer dereference",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-26690",
          "STATE": "PUBLIC",
          "TITLE": "mod_session NULL pointer dereference"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.46"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.43"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.41"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.39"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.38"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.37"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.35"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.34"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.33"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.29"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.28"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.27"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.26"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.25"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.23"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.20"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.18"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.17"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.16"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.12"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.10"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.9"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.7"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.6"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.4"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.3"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.2"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.1"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "This issue was discovered and reported by GHSL team member @antonio-morales (Antonio Morales)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "low"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "mod_session NULL pointer dereference"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-announce] 20210609 CVE-2021-26690: mod_session NULL pointer dereference",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rae406c1d19c0dfd3103c96923dadac2af1cd0bad6905ab1ede153865@%3Cannounce.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210609 CVE-2021-26690: Apache httpd: mod_session NULL pointer dereference",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/06/10/6"
            },
            {
              "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
            },
            {
              "name": "DSA-4937",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4937"
            },
            {
              "name": "GLSA-202107-38",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-38"
            },
            {
              "name": "FEDORA-2021-dce7e7738e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
            },
            {
              "name": "FEDORA-2021-e3f6dd670d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210702-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-26690",
    "datePublished": "2021-06-10T07:10:22",
    "dateReserved": "2021-02-04T00:00:00",
    "dateUpdated": "2024-08-03T20:33:40.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-13950 (GCVE-0-2020-13950)

Vulnerability from cvelistv5

Published

2021-06-10 07:10

Modified

2024-08-04 12:32

Severity ?

CWE

mod_proxy_http NULL pointer dereference

Summary

Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

References

URL

Tags

	http://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_MISC
	https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/rbe197409ae4a58b629fb792d1aed541ccbbf865121a80e1c5938d223%40%3Cannounce.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2021/06/10/4	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/202107-38	vendor-advisory, x_refsource_GENTOO
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210702-0001/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: 2.4.46 Version: 2.4.43 Version: 2.4.41

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-announce] 20210609 CVE-2020-13950: mod_proxy_http NULL pointer dereference",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbe197409ae4a58b629fb792d1aed541ccbbf865121a80e1c5938d223%40%3Cannounce.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210609 CVE-2020-13950: Apache httpd: mod_proxy_http NULL pointer dereference",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/06/10/4"
          },
          {
            "name": "GLSA-202107-38",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-38"
          },
          {
            "name": "FEDORA-2021-dce7e7738e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
          },
          {
            "name": "FEDORA-2021-e3f6dd670d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.46"
            },
            {
              "status": "affected",
              "version": "2.4.43"
            },
            {
              "status": "affected",
              "version": "2.4.41"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported by Marc Stern (\u003cmarc.stern approach.be\u003e)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "low"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "mod_proxy_http NULL pointer dereference",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:39:01",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-announce] 20210609 CVE-2020-13950: mod_proxy_http NULL pointer dereference",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rbe197409ae4a58b629fb792d1aed541ccbbf865121a80e1c5938d223%40%3Cannounce.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210609 CVE-2020-13950: Apache httpd: mod_proxy_http NULL pointer dereference",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/06/10/4"
        },
        {
          "name": "GLSA-202107-38",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-38"
        },
        {
          "name": "FEDORA-2021-dce7e7738e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
        },
        {
          "name": "FEDORA-2021-e3f6dd670d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "mod_proxy_http NULL pointer dereference",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2020-13950",
          "STATE": "PUBLIC",
          "TITLE": "mod_proxy_http NULL pointer dereference"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.46"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.43"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.41"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Reported by Marc Stern (\u003cmarc.stern approach.be\u003e)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "low"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "mod_proxy_http NULL pointer dereference"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-announce] 20210609 CVE-2020-13950: mod_proxy_http NULL pointer dereference",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rbe197409ae4a58b629fb792d1aed541ccbbf865121a80e1c5938d223@%3Cannounce.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210609 CVE-2020-13950: Apache httpd: mod_proxy_http NULL pointer dereference",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/06/10/4"
            },
            {
              "name": "GLSA-202107-38",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-38"
            },
            {
              "name": "FEDORA-2021-dce7e7738e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
            },
            {
              "name": "FEDORA-2021-e3f6dd670d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210702-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2020-13950",
    "datePublished": "2021-06-10T07:10:21",
    "dateReserved": "2020-06-08T00:00:00",
    "dateUpdated": "2024-08-04T12:32:14.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-35452 (GCVE-0-2020-35452)

Vulnerability from cvelistv5

Published

2021-06-10 07:10

Modified

2024-08-04 17:02

Severity ?

CWE

mod_auth_digest possible stack overflow by one nul byte

Summary

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

References

URL

Tags

	http://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_MISC
	https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/rccb1b8225583a48c6360edc7a93cc97ae8b0215791e455dc607e7602%40%3Cannounce.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2021/06/10/5	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2021/dsa-4937	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/202107-38	vendor-advisory, x_refsource_GENTOO
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210702-0001/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: 2.4.46 Version: 2.4.43 Version: 2.4.41 Version: 2.4.39 Version: 2.4.38 Version: 2.4.37 Version: 2.4.35 Version: 2.4.34 Version: 2.4.33 Version: 2.4.29 Version: 2.4.28 Version: 2.4.27 Version: 2.4.26 Version: 2.4.25 Version: 2.4.23 Version: 2.4.20 Version: 2.4.18 Version: 2.4.17 Version: 2.4.16 Version: 2.4.12 Version: 2.4.10 Version: 2.4.9 Version: 2.4.7 Version: 2.4.6 Version: 2.4.4 Version: 2.4.3 Version: 2.4.2 Version: 2.4.1 Version: 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:02:08.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-announce] 20210609 CVE-2020-35452: mod_auth_digest possible stack overflow by one nul byte",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rccb1b8225583a48c6360edc7a93cc97ae8b0215791e455dc607e7602%40%3Cannounce.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210609 CVE-2020-35452: Apache httpd: mod_auth_digest possible stack overflow by one nul byte",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/06/10/5"
          },
          {
            "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
          },
          {
            "name": "DSA-4937",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4937"
          },
          {
            "name": "GLSA-202107-38",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-38"
          },
          {
            "name": "FEDORA-2021-dce7e7738e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
          },
          {
            "name": "FEDORA-2021-e3f6dd670d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.46"
            },
            {
              "status": "affected",
              "version": "2.4.43"
            },
            {
              "status": "affected",
              "version": "2.4.41"
            },
            {
              "status": "affected",
              "version": "2.4.39"
            },
            {
              "status": "affected",
              "version": "2.4.38"
            },
            {
              "status": "affected",
              "version": "2.4.37"
            },
            {
              "status": "affected",
              "version": "2.4.35"
            },
            {
              "status": "affected",
              "version": "2.4.34"
            },
            {
              "status": "affected",
              "version": "2.4.33"
            },
            {
              "status": "affected",
              "version": "2.4.29"
            },
            {
              "status": "affected",
              "version": "2.4.28"
            },
            {
              "status": "affected",
              "version": "2.4.27"
            },
            {
              "status": "affected",
              "version": "2.4.26"
            },
            {
              "status": "affected",
              "version": "2.4.25"
            },
            {
              "status": "affected",
              "version": "2.4.23"
            },
            {
              "status": "affected",
              "version": "2.4.20"
            },
            {
              "status": "affected",
              "version": "2.4.18"
            },
            {
              "status": "affected",
              "version": "2.4.17"
            },
            {
              "status": "affected",
              "version": "2.4.16"
            },
            {
              "status": "affected",
              "version": "2.4.12"
            },
            {
              "status": "affected",
              "version": "2.4.10"
            },
            {
              "status": "affected",
              "version": "2.4.9"
            },
            {
              "status": "affected",
              "version": "2.4.7"
            },
            {
              "status": "affected",
              "version": "2.4.6"
            },
            {
              "status": "affected",
              "version": "2.4.4"
            },
            {
              "status": "affected",
              "version": "2.4.3"
            },
            {
              "status": "affected",
              "version": "2.4.2"
            },
            {
              "status": "affected",
              "version": "2.4.1"
            },
            {
              "status": "affected",
              "version": "2.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered and reported by GHSL team member @antonio-morales (Antonio Morales)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "low"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "mod_auth_digest possible stack overflow by one nul byte",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:39:46",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-announce] 20210609 CVE-2020-35452: mod_auth_digest possible stack overflow by one nul byte",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rccb1b8225583a48c6360edc7a93cc97ae8b0215791e455dc607e7602%40%3Cannounce.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210609 CVE-2020-35452: Apache httpd: mod_auth_digest possible stack overflow by one nul byte",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/06/10/5"
        },
        {
          "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
        },
        {
          "name": "DSA-4937",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4937"
        },
        {
          "name": "GLSA-202107-38",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-38"
        },
        {
          "name": "FEDORA-2021-dce7e7738e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
        },
        {
          "name": "FEDORA-2021-e3f6dd670d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "mod_auth_digest possible stack overflow by one nul byte",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2020-35452",
          "STATE": "PUBLIC",
          "TITLE": "mod_auth_digest possible stack overflow by one nul byte"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.46"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.43"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.41"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.39"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.38"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.37"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.35"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.34"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.33"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.29"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.28"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.27"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.26"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.25"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.23"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.20"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.18"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.17"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.16"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.12"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.10"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.9"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.7"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.6"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.4"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.3"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.2"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.1"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "This issue was discovered and reported by GHSL team member @antonio-morales (Antonio Morales)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "low"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "mod_auth_digest possible stack overflow by one nul byte"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-announce] 20210609 CVE-2020-35452: mod_auth_digest possible stack overflow by one nul byte",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rccb1b8225583a48c6360edc7a93cc97ae8b0215791e455dc607e7602@%3Cannounce.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210609 CVE-2020-35452: Apache httpd: mod_auth_digest possible stack overflow by one nul byte",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/06/10/5"
            },
            {
              "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
            },
            {
              "name": "DSA-4937",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4937"
            },
            {
              "name": "GLSA-202107-38",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-38"
            },
            {
              "name": "FEDORA-2021-dce7e7738e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
            },
            {
              "name": "FEDORA-2021-e3f6dd670d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210702-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2020-35452",
    "datePublished": "2021-06-10T07:10:21",
    "dateReserved": "2020-12-14T00:00:00",
    "dateUpdated": "2024-08-04T17:02:08.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-31618 (GCVE-0-2021-31618)

Vulnerability from cvelistv5

Published

2021-06-15 00:00

Modified

2024-08-03 23:03

Severity ?

CWE

CWE-476 - NULL Pointer Dereference

Summary

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.

References

URL

Tags

	http://httpd.apache.org/security/vulnerabilities_24.html
	http://www.openwall.com/lists/oss-security/2021/06/10/9	mailing-list
	https://seclists.org/oss-sec/2021/q2/206
	https://lists.apache.org/thread.html/r14b66ef0f4f569fd515a3f96cd4eb58bd9a8ff525cc326bb0359664f%40%3Ccvs.httpd.apache.org%3E	mailing-list
	https://lists.apache.org/thread.html/r783b6558abf3305b17ea462bed4bd66d82866438999bf38cef6d11d1%40%3Ccvs.httpd.apache.org%3E	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NKJ3ZA3FTSZ2QBBPKS6BYGAWYRABNQQ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A73QJ4HPUMU26I6EULG6SCK67TUEXZYR/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html	mailing-list
	https://www.debian.org/security/2021/dsa-4937	vendor-advisory
	https://security.gentoo.org/glsa/202107-38	vendor-advisory
	https://www.oracle.com/security-alerts/cpuoct2021.html
	https://security.netapp.com/advisory/ntap-20210727-0008/
	http://www.openwall.com/lists/oss-security/2024/03/13/2	mailing-list

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: 2.4.47

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-31618",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T16:18:33.082195Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:12:39.340Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:03:33.651Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "name": "[oss-security] 20210609 CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/06/10/9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://seclists.org/oss-sec/2021/q2/206"
          },
          {
            "name": "[httpd-cvs] 20210615 svn commit: r1890801 - /httpd/site/trunk/content/security/json/CVE-2021-31618.json",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r14b66ef0f4f569fd515a3f96cd4eb58bd9a8ff525cc326bb0359664f%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210615 svn commit: r1075782 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_24.html",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r783b6558abf3305b17ea462bed4bd66d82866438999bf38cef6d11d1%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "FEDORA-2021-051639aad4",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NKJ3ZA3FTSZ2QBBPKS6BYGAWYRABNQQ/"
          },
          {
            "name": "FEDORA-2021-181f29c392",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A73QJ4HPUMU26I6EULG6SCK67TUEXZYR/"
          },
          {
            "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
          },
          {
            "name": "DSA-4937",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4937"
          },
          {
            "name": "GLSA-202107-38",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-38"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210727-0008/"
          },
          {
            "name": "[oss-security] 20240313 Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/13/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.47"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Apache HTTP server would like to thank  LI ZHI XIN from NSFocus for reporting this."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "important"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:10:59.750770",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "name": "[oss-security] 20210609 CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/06/10/9"
        },
        {
          "url": "https://seclists.org/oss-sec/2021/q2/206"
        },
        {
          "name": "[httpd-cvs] 20210615 svn commit: r1890801 - /httpd/site/trunk/content/security/json/CVE-2021-31618.json",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r14b66ef0f4f569fd515a3f96cd4eb58bd9a8ff525cc326bb0359664f%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-cvs] 20210615 svn commit: r1075782 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_24.html",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread.html/r783b6558abf3305b17ea462bed4bd66d82866438999bf38cef6d11d1%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "FEDORA-2021-051639aad4",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NKJ3ZA3FTSZ2QBBPKS6BYGAWYRABNQQ/"
        },
        {
          "name": "FEDORA-2021-181f29c392",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A73QJ4HPUMU26I6EULG6SCK67TUEXZYR/"
        },
        {
          "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
        },
        {
          "name": "DSA-4937",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4937"
        },
        {
          "name": "GLSA-202107-38",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202107-38"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210727-0008/"
        },
        {
          "name": "[oss-security] 20240313 Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/03/13/2"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "NULL pointer dereference on specially crafted HTTP/2 request",
      "workarounds": [
        {
          "lang": "en",
          "value": "On unpatched servers, the `h2` protocol can be disabled by removing it from the `Protocols` configuration. If the `h2` protocol is not enabled, the server is not affected by this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-31618",
    "datePublished": "2021-06-15T00:00:00",
    "dateReserved": "2021-04-23T00:00:00",
    "dateUpdated": "2024-08-03T23:03:33.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-26691 (GCVE-0-2021-26691)

Vulnerability from cvelistv5

Published

2021-06-10 07:10

Modified

2024-08-03 20:33

Severity ?

CWE

CWE-122 - Heap-based Buffer Overflow

Summary

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

References

URL

Tags

	http://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_MISC
	https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2021/06/10/7	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2021/dsa-4937	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/202107-38	vendor-advisory, x_refsource_GENTOO
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210702-0001/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: 2.4.46 Version: 2.4.43 Version: 2.4.41 Version: 2.4.39 Version: 2.4.38 Version: 2.4.37 Version: 2.4.35 Version: 2.4.34 Version: 2.4.33 Version: 2.4.29 Version: 2.4.28 Version: 2.4.27 Version: 2.4.26 Version: 2.4.25 Version: 2.4.23 Version: 2.4.20 Version: 2.4.18 Version: 2.4.17 Version: 2.4.16 Version: 2.4.12 Version: 2.4.10 Version: 2.4.9 Version: 2.4.7 Version: 2.4.6 Version: 2.4.4 Version: 2.4.3 Version: 2.4.2 Version: 2.4.1 Version: 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:33:40.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/06/10/7"
          },
          {
            "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
          },
          {
            "name": "DSA-4937",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4937"
          },
          {
            "name": "GLSA-202107-38",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-38"
          },
          {
            "name": "FEDORA-2021-dce7e7738e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
          },
          {
            "name": "FEDORA-2021-e3f6dd670d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.46"
            },
            {
              "status": "affected",
              "version": "2.4.43"
            },
            {
              "status": "affected",
              "version": "2.4.41"
            },
            {
              "status": "affected",
              "version": "2.4.39"
            },
            {
              "status": "affected",
              "version": "2.4.38"
            },
            {
              "status": "affected",
              "version": "2.4.37"
            },
            {
              "status": "affected",
              "version": "2.4.35"
            },
            {
              "status": "affected",
              "version": "2.4.34"
            },
            {
              "status": "affected",
              "version": "2.4.33"
            },
            {
              "status": "affected",
              "version": "2.4.29"
            },
            {
              "status": "affected",
              "version": "2.4.28"
            },
            {
              "status": "affected",
              "version": "2.4.27"
            },
            {
              "status": "affected",
              "version": "2.4.26"
            },
            {
              "status": "affected",
              "version": "2.4.25"
            },
            {
              "status": "affected",
              "version": "2.4.23"
            },
            {
              "status": "affected",
              "version": "2.4.20"
            },
            {
              "status": "affected",
              "version": "2.4.18"
            },
            {
              "status": "affected",
              "version": "2.4.17"
            },
            {
              "status": "affected",
              "version": "2.4.16"
            },
            {
              "status": "affected",
              "version": "2.4.12"
            },
            {
              "status": "affected",
              "version": "2.4.10"
            },
            {
              "status": "affected",
              "version": "2.4.9"
            },
            {
              "status": "affected",
              "version": "2.4.7"
            },
            {
              "status": "affected",
              "version": "2.4.6"
            },
            {
              "status": "affected",
              "version": "2.4.4"
            },
            {
              "status": "affected",
              "version": "2.4.3"
            },
            {
              "status": "affected",
              "version": "2.4.2"
            },
            {
              "status": "affected",
              "version": "2.4.1"
            },
            {
              "status": "affected",
              "version": "2.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Discovered internally Christophe Jaillet"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "low"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-07T14:41:53",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe%40%3Cannounce.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/06/10/7"
        },
        {
          "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
        },
        {
          "name": "DSA-4937",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4937"
        },
        {
          "name": "GLSA-202107-38",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-38"
        },
        {
          "name": "FEDORA-2021-dce7e7738e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
        },
        {
          "name": "FEDORA-2021-e3f6dd670d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache HTTP Server mod_session response handling heap overflow",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-26691",
          "STATE": "PUBLIC",
          "TITLE": "Apache HTTP Server mod_session response handling heap overflow"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.46"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.43"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.41"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.39"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.38"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.37"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.35"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.34"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.33"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.29"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.28"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.27"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.26"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.25"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.23"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.20"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.18"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.17"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.16"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.12"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.10"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.9"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.7"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.6"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.4"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.3"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.2"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.1"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Discovered internally Christophe Jaillet"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "low"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-122 Heap-based Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-announce] 20210609 CVE-2021-26691: mod_session response handling heap overflow",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe@%3Cannounce.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210609 CVE-2021-26691: Apache httpd: mod_session response handling heap overflow",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/06/10/7"
            },
            {
              "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
            },
            {
              "name": "DSA-4937",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4937"
            },
            {
              "name": "GLSA-202107-38",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-38"
            },
            {
              "name": "FEDORA-2021-dce7e7738e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
            },
            {
              "name": "FEDORA-2021-e3f6dd670d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210702-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-26691",
    "datePublished": "2021-06-10T07:10:23",
    "dateReserved": "2021-02-04T00:00:00",
    "dateUpdated": "2024-08-03T20:33:40.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-30641 (GCVE-0-2021-30641)

Vulnerability from cvelistv5

Published

2021-06-10 07:10

Modified

2024-08-03 22:40

Severity ?

CWE

Unexpected URL matching with 'MergeSlashes OFF'

Summary

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

References

URL

Tags

	http://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_MISC
	https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E	x_refsource_MISC
	https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10%40%3Cannounce.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2021/06/10/8	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2021/dsa-4937	vendor-advisory, x_refsource_DEBIAN
	https://security.gentoo.org/glsa/202107-38	vendor-advisory, x_refsource_GENTOO
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210702-0001/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache HTTP Server	Version: 2.4.46 Version: 2.4.43 Version: 2.4.41 Version: 2.4.39

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T22:40:31.820Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-announce] 20210609 CVE-2021-30641: Unexpected URL matching with \u0027MergeSlashes OFF\u0027",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10%40%3Cannounce.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
          },
          {
            "name": "[oss-security] 20210609 CVE-2021-30641: Apache httpd: Unexpected URL matching with \u0027MergeSlashes OFF\u0027",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/06/10/8"
          },
          {
            "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
          },
          {
            "name": "DSA-4937",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4937"
          },
          {
            "name": "GLSA-202107-38",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-38"
          },
          {
            "name": "FEDORA-2021-dce7e7738e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
          },
          {
            "name": "FEDORA-2021-e3f6dd670d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.46"
            },
            {
              "status": "affected",
              "version": "2.4.43"
            },
            {
              "status": "affected",
              "version": "2.4.41"
            },
            {
              "status": "affected",
              "version": "2.4.39"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Discovered by Christoph Anton Mitterer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with \u0027MergeSlashes OFF\u0027"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unexpected URL matching with \u0027MergeSlashes OFF\u0027",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T10:42:12",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-announce] 20210609 CVE-2021-30641: Unexpected URL matching with \u0027MergeSlashes OFF\u0027",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10%40%3Cannounce.httpd.apache.org%3E"
        },
        {
          "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E"
        },
        {
          "name": "[oss-security] 20210609 CVE-2021-30641: Apache httpd: Unexpected URL matching with \u0027MergeSlashes OFF\u0027",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/06/10/8"
        },
        {
          "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
        },
        {
          "name": "DSA-4937",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4937"
        },
        {
          "name": "GLSA-202107-38",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-38"
        },
        {
          "name": "FEDORA-2021-dce7e7738e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
        },
        {
          "name": "FEDORA-2021-e3f6dd670d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unexpected URL matching with \u0027MergeSlashes OFF\u0027",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-30641",
          "STATE": "PUBLIC",
          "TITLE": "Unexpected URL matching with \u0027MergeSlashes OFF\u0027"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache HTTP Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.46"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.43"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.41"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.4",
                            "version_value": "2.4.39"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Discovered by Christoph Anton Mitterer"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with \u0027MergeSlashes OFF\u0027"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "moderate"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Unexpected URL matching with \u0027MergeSlashes OFF\u0027"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://httpd.apache.org/security/vulnerabilities_24.html",
              "refsource": "MISC",
              "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
            },
            {
              "name": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-announce] 20210609 CVE-2021-30641: Unexpected URL matching with \u0027MergeSlashes OFF\u0027",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10@%3Cannounce.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E"
            },
            {
              "name": "[oss-security] 20210609 CVE-2021-30641: Apache httpd: Unexpected URL matching with \u0027MergeSlashes OFF\u0027",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/06/10/8"
            },
            {
              "name": "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html"
            },
            {
              "name": "DSA-4937",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4937"
            },
            {
              "name": "GLSA-202107-38",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-38"
            },
            {
              "name": "FEDORA-2021-dce7e7738e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/"
            },
            {
              "name": "FEDORA-2021-e3f6dd670d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210702-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210702-0001/"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-30641",
    "datePublished": "2021-06-10T07:10:24",
    "dateReserved": "2021-04-13T00:00:00",
    "dateUpdated": "2024-08-03T22:40:31.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2021:2127-1

Vulnerability from csaf_suse

CVE-2021-26690 (GCVE-0-2021-26690)

Vulnerability from cvelistv5

CVE-2020-13950 (GCVE-0-2020-13950)

Vulnerability from cvelistv5

CVE-2020-35452 (GCVE-0-2020-35452)

Vulnerability from cvelistv5

CVE-2021-31618 (GCVE-0-2021-31618)

Vulnerability from cvelistv5

CVE-2021-26691 (GCVE-0-2021-26691)

Vulnerability from cvelistv5

CVE-2021-30641 (GCVE-0-2021-30641)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature