CVE-2021-44224

Published: Dec 20, 2021Modified: Jun 17, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Exploitability: 3.9 / Impact: 4.2

Source: NVD

Description

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Affected (37)

Products: Apache: Http Server · Fedoraproject: Fedora · Debian: Debian Linux · +3 more

Show all products

Apache: Http Server · Fedoraproject: Fedora · Debian: Debian Linux · Tenable: Tenable.sc · Oracle: Communications Element Manager, Communications Operations Monitor, Communications Session Report Manager, Communications Session Route Manager, Http Server, Instantis Enterprisetrack · Apple: Mac Os X, Macos

1 product

1 product

1 product

1 product

6 products

Communications Element Manager

Communications Operations Monitor

Communications Session Report Manager

Communications Session Route Manager

Http Server

Instantis Enterprisetrack

Apple

2 products

Mac Os X

Macos

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 2.4.7 to 2.4.52

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Tenable.sc	From 5.14.0 to 5.20.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Tenable.sc	From 5.16.0 to 202201.1

Configuration F

13 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Element Manager	Before 9.0
Oracle Communications Operations Monitor	Version 4.0
Oracle Communications Operations Monitor	Version 4.3
Oracle Communications Operations Monitor	Version 4.4
Oracle Communications Operations Monitor	Version 5.0
Oracle Communications Session Report Manager	Before 9.0
Oracle Communications Session Route Manager	Before 9.0
Oracle Http Server	All versions
Oracle Http Server	Version 12.2.1.3.0
Oracle Http Server	Version 12.2.1.4.0
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3

Configuration G

16 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Version 10.15.7
Apple Mac Os X	Version 10.15.7 security_update_2020-001
Apple Mac Os X	Version 10.15.7 security_update_2021-001
Apple Mac Os X	Version 10.15.7 security_update_2021-002
Apple Mac Os X	Version 10.15.7 security_update_2021-003
Apple Mac Os X	Version 10.15.7 security_update_2021-004
Apple Mac Os X	Version 10.15.7 security_update_2021-005
Apple Mac Os X	Version 10.15.7 security_update_2021-006
Apple Mac Os X	Version 10.15.7 security_update_2021-007
Apple Mac Os X	Version 10.15.7 security_update_2021-008
Apple Mac Os X	Version 10.15.7 security_update_2022-001
Apple Mac Os X	Version 10.15.7 security_update_2022-002
Apple Mac Os X	Version 10.15.7 security_update_2022-003
Apple Macos	Before 10.15.7
Apple Macos	From 11.0 to 11.6.6
Apple Macos	From 12.0.0 to 12.4

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (38)

http://httpd.apache.org/security/vulnerabilities_24.html

Source: security@apache.org

Vendor Advisory

http://seclists.org/fulldisclosure/2022/May/33

Source: security@apache.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/May/35

Source: security@apache.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/May/38

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/12/20/3

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFSWOH4X77CV7AH7C4RMHUBDWKQDL4YH/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/

Source: security@apache.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/

Source: security@apache.org

https://security.gentoo.org/glsa/202208-20

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211224-0001/

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213255

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213256

Source: security@apache.org

Third Party Advisory

https://support.apple.com/kb/HT213257

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2022/dsa-5035

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.tenable.com/security/tns-2022-01

Source: security@apache.org

Third Party Advisory

https://www.tenable.com/security/tns-2022-03

Source: security@apache.org

Third Party Advisory

http://httpd.apache.org/security/vulnerabilities_24.html