Apache HTTP Multiple Vulnerabilities

Multiple vulnerabilities were identified in Apache HTTP Server, a remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, information disclosure, security restriction bypass  and remote code execution on the targeted system.

HKCERT is aware of these vulnerabilities have been reported publicly that they are being exploited in the wild, and encourages users and administrators to review the security update pages for the affected products and apply the related updates as soon as possible.

Note:
CVE-2021-41773 is being exploited in the wild.

[Updated on 2021-10-07] It was reported by security researcher that exploiting CVE-2021-41773 may trigger remote code execution if "mod-cgi" function is enabled and missing "require all denied" function.

[Updated on 2021-10-08] Apache has released patch to address the incomplete fix of CVE-2021-41773. Updated "System / Technologies affected", "Solutions", "Vulnerability Identifier" and "Related Links" sections.