Re: [users@httpd] Regarding CVE-2021-40438

2021-10-19 Thread alchemist vk
Thanks Nick for your response. I recently started looking to webserver and getting hands-on with these things. So I thought I can get higher exposure if I learn more about these CVEs and implications. So I posted the question in this forum. With Regards, Venkatesh On Tue, Oct 19, 2021 at 4:05 PM

Re: [users@httpd] Regarding CVE-2021-40438

2021-10-19 Thread Nick Folino
Nobody here is going to tell you how to exploit vulnerabilities. If you can't figure it out by reading the code then upgrade to the fixed version. Nick On Tue, Oct 19, 2021 at 2:49 AM alchemist vk wrote: > Hi All, > I understand that, CVE-2021-40438 is fixed in httpd release 2.4.50 > onwards.

[users@httpd] Regarding CVE-2021-40438

2021-10-19 Thread alchemist vk
Hi All, I understand that, CVE-2021-40438 is fixed in httpd release 2.4.50 onwards. But I would like to know more about, how this issue can be exploitable in prior versions and can I know the commit id/patch details for this issue. Tried looking into commit details in github apache repo, but