CVE-2021-41773 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	High
Remote	Yes
Type	Directory traversal
Description	A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-2442	apache	2.4.49-1	2.4.50-1	High	Fixed

References
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773 https://svn.apache.org/viewvc?view=revision&revision=1893775