Linux · Security advisory · November 9, 2021

ALSA-2021:4537: Security update for 11 packages

ALSA-2021:4537, released November 9, 2021, fixes 3 CVEs across 11 products. One of them is being exploited (CVE-2021-40438); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEVKnown ransomware use
CVEs closed
3
None rated Critical
Exploited
1
CVE-2021-40438
Exploitation more likely
0
Vendor assessment
Highest EPSS
1.0000
99th percentile

Priority of the 3 CVEs

Patch now 1 Urgent 0 High 2 Routine 0

Fixed package versions

ProductReleaseFixed in
httpdalmalinux 82.4.37-43.module_el8.5.0+2597+c4b14997.alma
httpd-develalmalinux 82.4.37-43.module_el8.5.0+2597+c4b14997.alma
httpd-filesystemalmalinux 82.4.37-43.module_el8.5.0+2597+c4b14997.alma
httpd-manualalmalinux 82.4.37-43.module_el8.5.0+2597+c4b14997.alma
httpd-toolsalmalinux 82.4.37-43.module_el8.5.0+2597+c4b14997.alma
mod_http2almalinux 81.15.7-3.module_el8.5.0+2609+b30d9eec
mod_ldapalmalinux 82.4.37-43.module_el8.5.0+2597+c4b14997.alma
mod_mdalmalinux 81:2.0.8-8.module_el8.5.0+2609+b30d9eec
mod_proxy_htmlalmalinux 81:2.4.37-43.module_el8.5.0+2597+c4b14997.alma
mod_sessionalmalinux 82.4.37-43.module_el8.5.0+2597+c4b14997.alma
mod_sslalmalinux 81:2.4.37-43.module_el8.5.0+2597+c4b14997.alma

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2021-40438 httpd: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... 9.0 1.0000 KEVRansomwareExploited
High CVE-2021-26691 httpd-tools: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... 9.8 0.6807 None reported
High CVE-2021-20325 httpd-tools: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... 9.8 0.0159 None reported
Showing 1 to 3 of 3 1