CVE-2021-33193 Request splitting via HTTP/2 method injection and mod_proxy
Attackers can inject HTTP/2 methods to bypass validation and cause request splitting or cache poisoning in Apache HTTP Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-33193?
CVE-2021-33193 is a high-severity vulnerability in Apache Http Server, published on 16 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
Which versions are affected by CVE-2021-33193?
1 open source package ship an affected version, including apache. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.17 | 2.4.49 |
Linux distribution packages (10)
apache2 SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 2.4.43-3.25.1 |
apache2 SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 2.4.43-3.25.1 |
apache2 SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 2.4.43-3.25.1 |
apache2 SUSE:Linux Enterprise Module for Server Applications 15 SP2 | All versions | 2.4.43-3.25.1 |
apache2 SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 2.4.43-3.25.1 |
apache2 SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.4.23-29.77.2 |
apache2 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.4.23-29.77.2 |
apache2 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.4.23-29.77.2 |
apache2 openSUSE:Leap 15.2 | All versions | 2.4.43-lp152.2.18.1 |
apache2 openSUSE:Leap 15.3 | All versions | 2.4.43-3.25.1 |
Products include Apache Http Server, Debian Debian Linux, Fedoraproject Fedora, Oracle Secure Backup, Oracle Zfs Storage Appliance Kit, Tenable Tenable.sc.
How do I fix CVE-2021-33193?
Upgrade apache to 2.4.49 or later.
Is CVE-2021-33193 being exploited?
There is no known exploitation of CVE-2021-33193 in the wild and no public exploit code.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2021-33193, AZL-6483, BIT-apache-2021-33193, CLEANSTART-2026-XX88354, DEBIAN-CVE-2021-33193, GHSA-p9fg-6rr5-38xc and 5 more.