CVE-2021-26691 / CVE-2021-39275 / CVE-2021-44790: apache / httpd multiple CVEs

[Ghada Khalil]

CVE-2021-26691: httpd: mod_session: Heap overflow via a crafted SessionHeader value
CVE-2021-39275: httpd: Out-of-bounds write in ap_escape_quotes() via malicious input
CVE-2021-44790: httpd: mod_lua: Possible buffer overflow when parsing multipart content

Score:
cve_id status cvss2Score av ac au ai
CVE-2021-26691 fixed 7.5 N L N P
CVE-2021-39275 fixed 7.5 N L N P
CVE-2021-44790 fixed 7.5 N L N P

Description:
CVE-2021-26691: In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVE-2021-39275: ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE-2021-44790: A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

References:
• https://nvd.nist.gov/vuln/detail/CVE-2021-26691
• https://access.redhat.com/security/cve/cve-2021-26691
• https://nvd.nist.gov/vuln/detail/CVE-2021-39275
• https://access.redhat.com/security/cve/cve-2021-39275
• https://nvd.nist.gov/vuln/detail/CVE-2021-44790
• https://access.redhat.com/security/cve/cve-2021-44790
• https://access.redhat.com/errata/RHSA-2022:0143
• The 3 CVEs are fixed by CentOS per this announcement: https://lists.centos.org/pipermail/centos-announce/2022-January/073551.html

Required Package Versions:
httpd-2.4.6-97.el7_9.4.x86_64.rpm

Packages:
httpd

Found during January 2022 CVE scan using vulscan

[Ghada Khalil (gkhalil)]

Screening: Marking as medium priority as this CVE meets the StarlingX fix criteria. Should be fixed in stx master and considered for cherry-pick to stx.6.0 if a maintenance release is planned

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/834214

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/834214
Committed: https://opendev.org/starlingx/tools/commit/fc00096e8beb10f96ae0d33d3d0008d929c5f124
Submitter: "Zuul (22348)"
Branch: master

commit fc00096e8beb10f96ae0d33d3d0008d929c5f124
Author: Joe Slater <email address hidden>
Date: Thu Mar 17 14:27:32 2022 -0400

    httpd: fix three CVEs

    CVE-2021-26691: heap overflow
    CVE-2021-39275: out-of-bounds-write
    CVE-2021-44790: buffer overflow

    Advance to version 2.4.6-97.el7.centos.

    === testing
    boot iso and log in; become root; httpd is not running

     systemctl stop lighttpd # free up port 80
     systemctl start httpd # takes a while
     echo arf > /var/www/html/arf.txt # something to fetch
     wget http://localhost/arf.txt
     cat arf.txt

    This shows httpd is processing requests.
    ===

    Closes-bug: 1960765
    Signed-off-by: Joe Slater <email address hidden>
    Change-Id: Idcff71fe505a187e7bcfaea7a8818233a4ef76ac

[Michel Thebeau [WIND] (mthebeau)]

The vuls scan is report is still showing these CVEs as not fixed. According to the centos announcement, the fix for these three CVEs is in version 2.4.6-97.el7.centos.4

https://lists.centos.org/pipermail/centos-announce/2022-January/073551.html

Whereas the commit which closed this bug updated to version 2.4.6-97.el7.centos

[Ghada Khalil (gkhalil)]

Re-opening as Joe Slater confirmed the rpm version used does not fix the CVEs listed in this LP. We have also agreed to use the ".5" version of the rpm as it also addresses CVE-2022-22720 which was reported in the April vulscan and is tracked by https://bugs.launchpad.net/starlingx/+bug/1969363

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/838407
Committed: https://opendev.org/starlingx/tools/commit/a56902554f6069b61e9f19d404b6faa7dec6eb50
Submitter: "Zuul (22348)"
Branch: master

commit a56902554f6069b61e9f19d404b6faa7dec6eb50
Author: Joe Slater <email address hidden>
Date: Mon Apr 18 17:59:11 2022 -0400

    httpd: fix four CVEs

    NOTE! commit fc00096e8... purports to fix the first 3 CVEs
           but uses the wrong rpm version.

    CVE-2021-26691: heap overflow
    CVE-2021-39275: out-of-bounds write
    CVE-2021-44790: buffer overflow
    CVE-2022-22720: http request smuggling

    Advance to version 2.4.6-97.el7.centos.5.

    === testing
    boot iso and log in; become root; httpd is not running

     systemctl stop lighttpd # free up port 80
     systemctl start httpd # takes a while
     echo arf > /var/www/html/arf.txt # something to fetch
     wget http://localhost/arf.txt
     cat arf.txt

    This shows httpd is processing requests.
    ===

    Closes-bug: 1960765
    Closes-bug: 1969363
    Change-Id: I4c90213f020762f037e1f207f73e0622a38984c2
    Signed-off-by: Joe Slater <email address hidden>