MGASA-2021-0461 - Updated apache packages fix security vulnerabilities

Publication date: 06 Oct 2021
URL: https://advisories.mageia.org/MGASA-2021-0461.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2021-41524,
     CVE-2021-41773

The updated packages fix a security vulnerabilities:

While fuzzing the 2.4.49 httpd, a new null pointer dereference was
detected during HTTP/2 request processing, allowing an external source
to DoS the server. This requires a specially crafted request. The
vulnerability was recently introduced in version 2.4.49. No exploit is
known to the project (CVE-2021-41524).

A flaw was found in a change made to path normalization in Apache HTTP
Server 2.4.49. An attacker could use a path traversal attack to map URLs
to files outside the expected document root. If files outside of the
document root are not protected by "require all denied" these requests can
succeed. Additionally this flaw could leak the source of interpreted files
like CGI scripts. This issue is known to be exploited in the wild. This
issue only affects Apache 2.4.49 and not earlier versions (CVE-2021-41773).

References:
- https://bugs.mageia.org/show_bug.cgi?id=29530
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://downloads.apache.org/httpd/Announcement2.4.html
- - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41524
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773

SRPMS:
- 8/core/apache-2.4.50-1.mga8