CVE-2021-44224 vulnerability in Apache and Other Products
Published on December 20, 2021

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Timeline

2021-11-18

Reported to security team

2021-12-14

fixed by r1895955+r1896044 in 2.4.x 26 days later.

Weakness Type

NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.

Products Associated with CVE-2021-44224

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-44224 are published in these products:

Apache HTTP Server

Fedora Project Fedora

Canonical Ubuntu Linux

Debian Linux

Tenable Sc

Oracle Instantis Enterprisetrack

Oracle Http Server

Oracle Communications Operations Monitor

Oracle Communications Element Manager

Oracle Communications Session Report Manager

Oracle Communications Session Route Manager

Apple macOS

Affected Versions

Apache Software Foundation Apache HTTP Server:

Version 2.4.7 and below Apache HTTP Server 2.4* is affected.

Exploit Probability

EPSS

10.96%

Percentile

93.32%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.