CVE-2012-0021

Name	CVE-2012-0021
Description	The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
apache2 (PTS)	bullseye	2.4.62-1~deb11u1	fixed
	bullseye (security)	2.4.62-1~deb11u2	fixed
	bookworm, bookworm (security)	2.4.62-1~deb12u2	fixed
	sid, trixie	2.4.62-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
apache2	source	lenny	(not affected)
apache2	source	squeeze	(not affected)
apache2	source	(unstable)	2.2.22-1

[squeeze] - apache2 <not-affected> (Introduced in 2.2.17)
[lenny] - apache2 <not-affected> (Introduced in 2.2.17)