CLSA-2021-1635459129
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2021-1635459129.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2021-1635459129
- Upstream
- Published
- 2021-10-28T22:12:09Z
- Modified
- 2026-06-04T10:03:27Z
- Summary
- Fix CVE(s): CVE-2021-26690, CVE-2021-26691, CVE-2021-30641, CVE-2020-35452
- Details
-
- SECURITY UPDATE: Unexpected URL matching with 'MergeSlashes OFF'
- debian/patches/CVE-2021-30641.patch: legacy default slash-matching behavior with 'MergeSlashes OFF'.
- CVE-2021-30641
- SECURITY UPDATE: heap overflow in mod_session
- debian/patches/CVE-2021-26691.patch: A specially crafted SessionHeader sent by an origin server could cause a heap overflow.
- CVE-2021-26691
- SECURITY UPDATE: NULL pointer dereference in mod_session
- debian/patches/CVE-2021-26690.patch: A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service.
- CVE-2021-26690
- SECURITY UPDATE: mod_auth_digest possible stack overflow by one nul byte
- debian/patches/CVE-2020-35452.patch: A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest.
- CVE-2020-35452
- SECURITY UPDATE: Unexpected URL matching with 'MergeSlashes OFF'
- References