← Back

CVE-2021-39275

nvd nist
Published: Sep 16, 2021Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

Affected (17)

Show all products
Apache: Http Server · Fedoraproject: Fedora · Debian: Debian Linux · Netapp: Cloud Backup, Clustered Data Ontap, Storagegrid · Oracle: Http Server, Instantis Enterprisetrack, Zfs Storage Appliance Kit · Siemens: Sinec Nms, Sinema Server
Apache
1 product
Http Server
Fedoraproject
1 product
Fedora
Debian
1 product
Debian Linux
Netapp
3 products
Cloud Backup
Clustered Data Ontap
Storagegrid
Oracle
3 products
Http Server
Instantis Enterprisetrack
Zfs Storage Appliance Kit
Siemens
2 products
Sinec Nms
Sinema Server
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Http Server
Before 2.4.49
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 34
Fedora
Version 35
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 11.0
Debian Linux
Version 9.0
Configuration D
3 vulnerable
Vulnerable SoftwareAffected Versions
Cloud Backup
All versions
Clustered Data Ontap
All versions
Storagegrid
All versions
Configuration E
6 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Http Server
Version 12.2.1.3.0
Http Server
Version 12.2.1.4.0
Oracle
Instantis Enterprisetrack
Version 17.1
Instantis Enterprisetrack
Version 17.2
Instantis Enterprisetrack
Version 17.3
Zfs Storage Appliance Kit
Version 8.8
Configuration F
2 vulnerable
Vulnerable SoftwareAffected Versions
Sinec Nms
All versions
Sinema Server
Version 14.0

Related CWEs

CWE-787
Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.

References (30)

Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Release NotesVendor Advisory
Source: security@apache.org
Patch
Source: security@apache.org
Patch
Source: security@apache.org
Patch
Source: security@apache.org
Patch
Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: security@apache.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.