Date: Tue, 05 Oct 2021 09:02:50 +0000 From: Stefan Eissing <icing@...che.org> To: oss-security@...ts.openwall.com Subject: CVE-2021-41524: Apache HTTP Server: null pointer dereference in h2 fuzzing Severity: moderate Description: While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project. Mitigation: Disable the HTTP/2 protocol. Credit: Apache httpd team would like to thank LI ZHI XIN from NSFocus Security Team for reporting this issue. References: https://httpd.apache.org/security/vulnerabilities_24.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.