CVE-2021-20325 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Redhat Enterprise Linux

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-787 — Out-of-bounds WriteCWE-918 — Server-Side Request Forgery6 documents6 sources
Severity
9.8CRITICALNVD
EPSS
0.9%
top 23.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat Enterprise LinuxPaloalto Pan-os
Timeline
PublishedFeb 18
Latest updateFeb 14

Description

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstrea…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶Palo Altopaloalto/pan-os

Also affects: Enterprise Linux 8.5.0

🔴Vulnerability Details

2
GHSA
GHSA-4pm7-9gg5-72pv: Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8↗2022-02-19
▶
CVEList
CVE-2021-20325: Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8↗2022-02-18
▶

📋Vendor Advisories

3
Palo Alto
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS↗2024-02-14
▶
Red Hat
httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat Enterprise Linux 8.5↗2021-11-09
▶
Debian
CVE-2021-20325: apache2 - Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as...↗2021
▶
CVE-2021-20325 — Redhat Enterprise Linux vulnerability | cvebase