CVE-2021-31618— EasyApache 代码问题漏洞
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2021-31618 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
NULL pointer dereference on specially crafted HTTP/2 request
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.
来源: 美国国家漏洞数据库 NVD
CVSS Information
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
空指针解引用
来源: 美国国家漏洞数据库 NVD
Vulnerability Title
EasyApache 代码问题漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
EasyApache是Apache基金会的一个功能强大且易于使用的工具，内置在WHM/cPanel中，可以使用它来更新和配置Apache web服务器。 EasyApache 存在代码问题漏洞，该漏洞源于将NULL指针指向MOD_HTTP2、MOD_SESSION和MOD_PROXY_HTTP。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 2.4.47 | - |
二、漏洞 CVE-2021-31618 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2021-31618 的情报信息
请登录查看更多情报信息。
CVE-2021-31618 厂商安全公告 (5)
- https://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
- http://httpd.apache.org/security/vulnerabilities_24.htmlx_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210727-0008/x_refsource_CONFIRM
CVE-2021-31618 邮件列表归档 (8)
- https://seclists.org/oss-sec/2021/q2/206x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A73QJ4HPUMU26I6EULG6SCK67TUEXZYR/vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NKJ3ZA3FTSZ2QBBPKS6BYGAWYRABNQQ/vendor-advisoryx_refsource_FEDORA
IV. Related Vulnerabilities
V. Comments for CVE-2021-31618
暂无评论