oss-security - CVE-2021-41524: Apache HTTP Server: null pointer dereference in h2 fuzzing

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <bdea6093-16a6-a6c7-bd9f-a774fd158aec@apache.org>
Date: Tue, 05 Oct 2021 09:02:50 +0000
From: Stefan Eissing <icing@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-41524: Apache HTTP Server: null pointer dereference in h2
 fuzzing 

Severity: moderate

Description:

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing,
allowing an external source to DoS the server. This requires a specially crafted request. 

The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

Mitigation:

Disable the HTTP/2 protocol.

Credit:

Apache httpd team would like to thank LI ZHI XIN from NSFocus Security Team for reporting this issue.

References:

https://httpd.apache.org/security/vulnerabilities_24.html

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.