CVE-2021-20325CWE-119

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression…

published February 18, 2022

CVSS
—
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

⚠️ A simple update could inadvertently roll back your security! Red Hat Enterprise Linux 8.5.0 ships with missing fixes for previous vulnerabilities, making it a riskier choice than 8.4! 🔥 Think of it like a restaurant that serves a new dish without properly replacing the spoiled ingredients. You could end up with a meal that looks good on the menu but is actually unsafe to consume! If a user installs or updates to Red Hat Enterprise Linux 8.5.0, they might be vulnerable to previous CVEs that were patched in 8.4. This means attackers could exploit issues previously resolved, potentially leading to unauthorized access or other security breaches!

Put simply

Think of it like a restaurant that serves a new dish without properly replacing the spoiled ingredients. You could end up with a meal that looks good on the menu but is actually unsafe to consume! This CVE highlights a regression in the httpd component of Red Hat Enterprise Linux 8.5.0, which fails to include the fixes for vulnerabilities identified in CVE-2021-40438 and CVE-2021-26691. Essentially, the newer version dropped the ball on fixing previously resolved security issues, leaving the door open for potential exploits.

What to do

If a user installs or updates to Red Hat Enterprise Linux 8.5.0, they might be vulnerable to previous CVEs that were patched in 8.4. This means attackers could exploit issues previously resolved, potentially leading to unauthorized access or other security breaches! To safeguard your systems, if you're on Red Hat Enterprise Linux 8.5.0, consider downgrading to 8.4 until Red Hat provides an update that resolves this regression. Always keep an eye on security bulletins for patches and updates! 🛡️ You've got this! Stay vigilant, and with a little proactive maintenance, you'll keep your systems secure! 💪✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01593 · 75.5th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2022-02-18T17:50Z
EPSS history
Timeline
  • 18 FEB 17:50Z
    Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression…
    cvelistv5