Test ID:	1.3.6.1.4.1.25623.1.0.884194
Category:	CentOS Local Security Checks
Title:	CentOS: Security Advisory for httpd (CESA-2022:0143)
Summary:	The remote host is missing an update for the 'httpd'; package(s) announced via the CESA-2022:0143 advisory.
Description:	Summary: The remote host is missing an update for the 'httpd' package(s) announced via the CESA-2022:0143 advisory. Vulnerability Insight: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_lua: Possible buffer overflow when parsing multipart content (CVE-2021-44790) * httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691) * httpd: NULL pointer dereference via malformed requests (CVE-2021-34798) * httpd: Out-of-bounds write in ap_escape_quotes() via malicious input (CVE-2021-39275) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Affected Software/OS: 'httpd' package(s) on CentOS 7. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-26691 https://security.netapp.com/advisory/ntap-20210702-0001/ Debian Security Information: DSA-4937 (Google Search) https://www.debian.org/security/2021/dsa-4937 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/ https://security.gentoo.org/glsa/202107-38 http://httpd.apache.org/security/vulnerabilities_24.html https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E https://www.oracle.com/security-alerts/cpujan2022.html https://www.oracle.com/security-alerts/cpuoct2021.html https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html https://lists.apache.org/thread.html/r50cae1b71f1e7421069036b213c26da7d8f47dd59874e3bd956959fe@%3Cannounce.httpd.apache.org%3E https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E http://www.openwall.com/lists/oss-security/2021/06/10/7 Common Vulnerability Exposure (CVE) ID: CVE-2021-34798 Cisco Security Advisory: 20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ https://kc.mcafee.com/corporate/index?page=content&id=SB10379 https://security.netapp.com/advisory/ntap-20211008-0004/ https://www.tenable.com/security/tns-2021-17 Debian Security Information: DSA-4982 (Google Search) https://www.debian.org/security/2021/dsa-4982 https://security.gentoo.org/glsa/202208-20 https://www.oracle.com/security-alerts/cpuapr2022.html https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E Common Vulnerability Exposure (CVE) ID: CVE-2021-39275 https://httpd.apache.org/security/vulnerabilities_24.html Common Vulnerability Exposure (CVE) ID: CVE-2021-44790 https://security.netapp.com/advisory/ntap-20211224-0001/ https://www.tenable.com/security/tns-2022-01 https://www.tenable.com/security/tns-2022-03 Debian Security Information: DSA-5035 (Google Search) https://www.debian.org/security/2022/dsa-5035 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ http://seclists.org/fulldisclosure/2022/May/38 http://seclists.org/fulldisclosure/2022/May/35 http://seclists.org/fulldisclosure/2022/May/33 http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html http://www.openwall.com/lists/oss-security/2021/12/20/4
Copyright	Copyright (C) 2022 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.