CVE-2021-44790

Public on 2021-12-20
Modified on 2023-01-18
Description
A buffer overflow flaw in httpd's lua module could allow an out-of-bounds write. An attacker who is able to submit a crafted request to an httpd instance that is using the lua module may be able to cause an impact to confidentiality, integrity, and/or availability.
Severity
Important severity
Important
CVSS v3 Base Score
9.8
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core httpd 2022-01-18 ALAS2-2022-1737 Fixed
Amazon Linux 2023 httpd 2023-02-17 ALAS2023-2023-072 Fixed
Amazon Linux 1 httpd24 2022-01-18 ALAS-2022-1560 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv3 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P