CVE-2021-1495

Name	CVE-2021-1495
Description	Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3317-1, DSA-5354-1
Debian Bugs	1021276

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
snort (PTS)	buster	2.9.7.0-5	vulnerable
	buster (security)	2.9.20-0+deb10u1	fixed
	bullseye	2.9.15.1-5	vulnerable
	bullseye (security)	2.9.20-0+deb11u1	fixed
	sid	2.9.15.1-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
snort	source	buster	2.9.20-0+deb10u1	DLA-3317-1
snort	source	bullseye	2.9.20-0+deb11u1	DSA-5354-1
snort	source	(unstable)	(unfixed)		1021276

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-fp-bp-KfDdcQhc