oss-sec mailing list archives

CVE-2021-44790: Apache HTTP Server: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

From: Stefan Eissing <icing () apache org>
Date: Mon, 20 Dec 2021 10:36:28 +0000

Severity: high

Description:

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from 
Lua scripts).
The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one.

This issue affects Apache HTTP Server 2.4.51 and earlier.

Credit:

Chamal
Anonymous working with Trend Micro Zero Day Initiative

Current thread:

CVE-2021-44790: Apache HTTP Server: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier Stefan Eissing (Dec 20)