CVE-2012-0021

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 30.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-01-28 · updated 2026-06-16
Weakness: CWE-20

Description

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.

Affected products

Apache HTTP Server: 2.2.17, 2.2.18, 2.2.19, 2.2.20, 2.2.21

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
http://httpd.apache.org/security/vulnerabilities_22.html
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
http://marc.info/?l=bugtraq&m=133294460209056&w=2
http://marc.info/?l=bugtraq&m=133494237717847&w=2
http://rhn.redhat.com/errata/RHSA-2012-0542.html
http://rhn.redhat.com/errata/RHSA-2012-0543.html
http://secunia.com/advisories/48551
http://support.apple.com/kb/HT5501
http://svn.apache.org/viewvc?view=revision&revision=1227292
http://www.mandriva.com/security/advisories?name=MDVSA-2012:012
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

Get alerted when CVE-2012-0021 or the next vulnerability affects your stack