SUSE update for apache2
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2021-34798 CVE-2021-36160 CVE-2021-39275 CVE-2021-40438 |
| CWE-ID | CWE-476 CWE-125 CWE-119 CWE-918 |
| Exploitation vector | Network |
| Public exploit | Vulnerability #4 is being exploited in the wild. |
| Vulnerable software |
SUSE Linux Enterprise Module for Packagehub Subpackages Operating systems & Components / Operating system package or component apache2-utils-debuginfo Operating systems & Components / Operating system package or component apache2-utils Operating systems & Components / Operating system package or component apache2-prefork-debuginfo Operating systems & Components / Operating system package or component apache2-prefork Operating systems & Components / Operating system package or component apache2 Operating systems & Components / Operating system package or component apache2-event-debuginfo Operating systems & Components / Operating system package or component apache2-event Operating systems & Components / Operating system package or component apache2-doc Operating systems & Components / Operating system package or component apache2-worker-debuginfo Operating systems & Components / Operating system package or component apache2-worker Operating systems & Components / Operating system package or component apache2-devel Operating systems & Components / Operating system package or component apache2-debugsource Operating systems & Components / Operating system package or component apache2-debuginfo Operating systems & Components / Operating system package or component SUSE Linux Enterprise Module for Server Applications Operating systems & Components / Operating system SUSE Linux Enterprise Module for Basesystem Operating systems & Components / Operating system |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) NULL pointer dereference
EUVDB-ID: #VU56681
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-34798
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send a specially crafted HTTP request to the affected web server and perform a denial of service (DoS) attack.
MitigationUpdate the affected package apache2 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3
SUSE Linux Enterprise Module for Server Applications: 15-SP2 - 15-SP3
SUSE Linux Enterprise Module for Basesystem: 15-SP2 - 15-SP3
apache2-utils-debuginfo: before 2.4.43-3.32.1
apache2-utils: before 2.4.43-3.32.1
apache2-prefork-debuginfo: before 2.4.43-3.32.1
apache2-prefork: before 2.4.43-3.32.1
apache2: before 2.4.43-3.32.1
apache2-event-debuginfo: before 2.4.43-3.32.1
apache2-event: before 2.4.43-3.32.1
apache2-doc: before 2.4.43-3.32.1
apache2-worker-debuginfo: before 2.4.43-3.32.1
apache2-worker: before 2.4.43-3.32.1
apache2-devel: before 2.4.43-3.32.1
apache2-debugsource: before 2.4.43-3.32.1
apache2-debuginfo: before 2.4.43-3.32.1
CPE2.3- cpe:2.3:a:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_server_applications:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_server_applications:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:a:suse:apache2-utils-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-prefork-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-prefork:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-event-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-event:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-worker-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-worker:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213522-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Out-of-bounds read
EUVDB-ID: #VU56680
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-36160
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in the mod_proxy_uwsgi module in Apache HTTP Server. A remote attacker can send an HTTP request with specially crafted uri-path, trigger an out-of-bounds read and perform a denial of service (DoS) attack.
Update the affected package apache2 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3
SUSE Linux Enterprise Module for Server Applications: 15-SP2 - 15-SP3
SUSE Linux Enterprise Module for Basesystem: 15-SP2 - 15-SP3
apache2-utils-debuginfo: before 2.4.43-3.32.1
apache2-utils: before 2.4.43-3.32.1
apache2-prefork-debuginfo: before 2.4.43-3.32.1
apache2-prefork: before 2.4.43-3.32.1
apache2: before 2.4.43-3.32.1
apache2-event-debuginfo: before 2.4.43-3.32.1
apache2-event: before 2.4.43-3.32.1
apache2-doc: before 2.4.43-3.32.1
apache2-worker-debuginfo: before 2.4.43-3.32.1
apache2-worker: before 2.4.43-3.32.1
apache2-devel: before 2.4.43-3.32.1
apache2-debugsource: before 2.4.43-3.32.1
apache2-debuginfo: before 2.4.43-3.32.1
CPE2.3- cpe:2.3:a:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_server_applications:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_server_applications:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:a:suse:apache2-utils-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-prefork-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-prefork:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-event-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-event:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-worker-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-worker:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213522-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Buffer overflow
EUVDB-ID: #VU56679
Risk: Medium
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-39275
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system or perform a denial of service attack.
The vulnerability exists due to a boundary error within the ap_escape_quotes() function. A remote attacker can send a specially crafted request to the web server, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the Apache module passes untrusted data to the affected function.
According to vendor, No included modules pass untrusted data to these functions
MitigationUpdate the affected package apache2 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3
SUSE Linux Enterprise Module for Server Applications: 15-SP2 - 15-SP3
SUSE Linux Enterprise Module for Basesystem: 15-SP2 - 15-SP3
apache2-utils-debuginfo: before 2.4.43-3.32.1
apache2-utils: before 2.4.43-3.32.1
apache2-prefork-debuginfo: before 2.4.43-3.32.1
apache2-prefork: before 2.4.43-3.32.1
apache2: before 2.4.43-3.32.1
apache2-event-debuginfo: before 2.4.43-3.32.1
apache2-event: before 2.4.43-3.32.1
apache2-doc: before 2.4.43-3.32.1
apache2-worker-debuginfo: before 2.4.43-3.32.1
apache2-worker: before 2.4.43-3.32.1
apache2-devel: before 2.4.43-3.32.1
apache2-debugsource: before 2.4.43-3.32.1
apache2-debuginfo: before 2.4.43-3.32.1
CPE2.3- cpe:2.3:a:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_server_applications:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_server_applications:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:a:suse:apache2-utils-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-prefork-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-prefork:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-event-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-event:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-worker-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-worker:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213522-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Server-Side Request Forgery (SSRF)
EUVDB-ID: #VU56678
Risk: High
CVSSv4.0: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:A/U:Amber]
CVE-ID: CVE-2021-40438
CWE-ID:
CWE-918 - Server-Side Request Forgery (SSRF)
Exploit availability: Yes
DescriptionThe disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input within the mod_proxy module in Apache HTTP Server. A remote attacker can send a specially crafted HTTP request with a chosen uri-path and trick the web server to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
MitigationUpdate the affected package apache2 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3
SUSE Linux Enterprise Module for Server Applications: 15-SP2 - 15-SP3
SUSE Linux Enterprise Module for Basesystem: 15-SP2 - 15-SP3
apache2-utils-debuginfo: before 2.4.43-3.32.1
apache2-utils: before 2.4.43-3.32.1
apache2-prefork-debuginfo: before 2.4.43-3.32.1
apache2-prefork: before 2.4.43-3.32.1
apache2: before 2.4.43-3.32.1
apache2-event-debuginfo: before 2.4.43-3.32.1
apache2-event: before 2.4.43-3.32.1
apache2-doc: before 2.4.43-3.32.1
apache2-worker-debuginfo: before 2.4.43-3.32.1
apache2-worker: before 2.4.43-3.32.1
apache2-devel: before 2.4.43-3.32.1
apache2-debugsource: before 2.4.43-3.32.1
apache2-debuginfo: before 2.4.43-3.32.1
CPE2.3- cpe:2.3:a:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_server_applications:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_server_applications:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:a:suse:apache2-utils-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-prefork-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-prefork:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-event-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-event:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-worker-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-worker:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:apache2-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-20213522-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
