RHSA-2022:0143 — Security Advisory

An update for httpd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: mod_lua: Possible buffer overflow when parsing multipart content (CVE-2021-44790)

• httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691)

• httpd: NULL pointer dereference via malformed requests (CVE-2021-34798)

• httpd: Out-of-bounds write in ap_escape_quotes() via malicious input (CVE-2021-39275)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.