According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow     (CVE-2020-35452)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service (CVE-2021-26690)

  - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server     could cause a heap overflow (CVE-2021-26691)

  - Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     (CVE-2021-30641)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2774:01 advisory.

    * httpd: mod_session: NULL pointer dereference when parsing Cookie header (CVE-2021-26690)
      * httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2541:01 advisory.

    httpd: mod_session: NULL pointer dereference when parsing Cookie header     (CVE-2021-26690)         httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)         httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in MIRACLE     LINUX 8.4 (CVE-2021-20325)     CVE(s):
    CVE-2021-26690     Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service     CVE-2021-30641     Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     CVE-2021-20325
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.
    Modularity name: httpd     Stream name: 2.4

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4257 advisory.

    * httpd: mod_session: NULL pointer dereference when parsing Cookie header (CVE-2021-26690)

    * httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 / SLES_SAP11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14749-1 advisory.

    - fixed CVE-2021-30641 [bsc#1187174]: MergeSlashes regression
    - fixed CVE-2020-35452 [bsc#1186922]: Single zero byte stack overflow in mod_auth_digest

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2127-1 advisory.

  - Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer     dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers,     leading to a Denial of Service (CVE-2020-13950)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow     (CVE-2020-35452)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service (CVE-2021-26690)

  - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server     could cause a heap overflow (CVE-2021-26691)

  - Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     (CVE-2021-30641)

  - Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the     size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of     these restrictions and HTTP response is sent to the client with a status code indicating why the request     was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the     offending header was the very first one received or appeared in a a footer. This led to a NULL pointer     dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2     request is easy to craft and submit, this can be exploited to DoS the server. This issue affected     mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never     released. (CVE-2021-31618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow     (CVE-2020-35452)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service (CVE-2021-26690)

  - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server     could cause a heap overflow (CVE-2021-26691)

  - Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     (CVE-2021-30641)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202107-38 (Apache: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
153679	EulerOS 2.0 SP9 : httpd (EulerOS-SA-2021-2553)	Nessus	Huawei Local Security Checks	9/27/2021	9/27/2021	critical
294360	MiracleLinux 8 : httpd:2.4 (AXSA:2021-2774:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	medium
294771	MiracleLinux 8 : httpd:2.4 (AXSA:2021-2541:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical
158878	AlmaLinux 8 : httpd:2.4 (ALSA-2021:4257)	Nessus	Alma Linux Local Security Checks	3/12/2022	1/13/2025	medium
150902	SUSE SLES11: apache2 / apache2-doc / apache2-example-pages / apache2-prefork / etc (SUSE-SU-2021:14749-1)	Nessus	SuSE Local Security Checks	6/21/2021	6/25/2026	high
151694	openSUSE 15 Security Update : apache2 (openSUSE-SU-2021:2127-1)	Nessus	SuSE Local Security Checks	7/16/2021	9/24/2021	critical
155517	EulerOS Virtualization 2.9.0 : httpd (EulerOS-SA-2021-2779)	Nessus	Huawei Local Security Checks	11/17/2021	4/18/2022	critical
156972	GLSA-202107-38 : Apache: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/24/2022	1/26/2022	critical

Detections

Analytics

Plugins Search

critical

medium

critical

medium

high

critical

critical

critical