RHSA-2021:3746HighCVSS 9.0

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP9 security update

Published
October 7, 2021
Last Modified
August 8, 2026

🔗 CVE IDs covered (1)

CVE-2021-40438 →

📋 Description

CVE-2021-40438 — httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:"

🎯 Affected products61

  • Red Hat JBoss Core Services on RHEL 7 Server
  • Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-httpd-0:2.4.37-76.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-httpd-0:2.4.37-76.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-httpd-0:2.4.37-76.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-0:2.4.37-76.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-debuginfo-0:2.4.37-76.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-httpd-debuginfo-0:2.4.37-76.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-devel-0:2.4.37-76.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-httpd-devel-0:2.4.37-76.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-manual-0:2.4.37-76.el8jbcs.noarch as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-httpd-manual-0:2.4.37-76.jbcs.el7.noarch as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-selinux-0:2.4.37-76.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-httpd-selinux-0:2.4.37-76.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-tools-0:2.4.37-76.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-httpd-tools-0:2.4.37-76.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-tools-debuginfo-0:2.4.37-76.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-mod_cluster-native-0:1.3.16-7.Final_redhat_2.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-mod_cluster-native-0:1.3.16-7.Final_redhat_2.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-mod_cluster-native-0:1.3.16-7.Final_redhat_2.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_cluster-native-0:1.3.16-7.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.16-7.Final_redhat_2.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.16-7.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_http2-0:1.15.7-19.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-mod_http2-0:1.15.7-19.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-mod_http2-0:1.15.7-19.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_http2-0:1.15.7-19.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-19.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-mod_http2-debuginfo-0:1.15.7-19.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_jk-0:1.2.48-18.redhat_1.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8
  • +31 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (4)