CVE-2021-20325
📋 TL;DR
CVE-2021-20325 is a Red Hat-specific security regression where fixes for CVE-2021-40438 and CVE-2021-26691 were missing in httpd packages shipped with RHEL 8.5.0, making systems vulnerable to those CVEs even though they were properly fixed in RHEL 8.4. This affects users who installed or updated to RHEL 8.5.0.
💻 Affected Systems
- httpd (Apache HTTP Server)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise via the underlying vulnerabilities (CVE-2021-40438 and CVE-2021-26691) that should have been patched.
Likely Case
Denial of service, information disclosure, or privilege escalation depending on which underlying CVE is exploited.
If Mitigated
No impact if systems are properly patched or workarounds are applied.
🎯 Exploit Status
Exploits target the underlying CVEs (CVE-2021-40438 and CVE-2021-26691) which have known vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to RHEL 8.5.0 with corrected httpd packages or later versions
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2017321
Restart Required: Yes
Instructions:
1. Update system: sudo yum update httpd 2. Verify update: rpm -q httpd 3. Restart httpd: sudo systemctl restart httpd
🔧 Temporary Workarounds
Downgrade to RHEL 8.4
linuxRevert to RHEL 8.4 where the fixes were properly applied
Consult Red Hat support for downgrade procedures
Disable affected modules
linuxDisable mod_proxy or other modules if not needed to reduce attack surface
Comment out LoadModule lines in httpd.conf for unused modules
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Use web application firewall (WAF) rules to block exploit patterns
🔍 How to Verify
Check if Vulnerable:
Check RHEL version and httpd package: cat /etc/redhat-release && rpm -q httpdCheck Version:
rpm -q httpd --queryformat '%{VERSION}-%{RELEASE}\n'Verify Fix Applied:
Verify httpd package version is updated and matches fixed release from Red Hat advisory📡 Detection & Monitoring
Log Indicators:
- Unusual requests to mod_proxy endpoints
- Error logs showing malformed requests
Network Indicators:
- Exploit traffic patterns for CVE-2021-40438 and CVE-2021-26691
SIEM Query:
source="apache" AND (error_code="500" OR request_uri CONTAINS "proxy")