Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-31813: A flaw was found in the mod_proxy module of httpd. The server may remove the X-Forwarded-* headers from a request based on the client-side Connection header hop-by-hop mechanism. CVE-2022-30556: A flaw was found in the mod_lua module of httpd. The data returned by the wsread function may point past the end of the storage allocated for the buffer, resulting in information disclosure. CVE-2022-30522: A flaw was found in the mod_sed module of httpd. A very large input to the mod_sed module can result in a denial of service due to excessively large memory allocations. CVE-2022-29404: A flaw was found in the mod_lua module of httpd. A malicious request to a Lua script that calls parsebody(0) can lead to a denial of service due to no default limit on the possible input size. CVE-2022-28615: An out-of-bounds read vulnerability was found in httpd. A very large input to the ap_strcmp_match function can lead to an integer overflow and result in an out-of-bounds read. CVE-2022-28614: An out-of-bounds read vulnerability was found in httpd. A very large input to the ap_rputs and ap_rwrite functions can lead to an integer overflow and result in an out-of-bounds read. CVE-2022-28330: An out-of-bounds read vulnerability was found in the mod_isapi module of httpd. The issue occurs when httpd is configured to process requests with the mod_isapi module. CVE-2022-26377: An HTTP request smuggling vulnerability was found in the mod_proxy_ajp module of httpd. This flaw allows an attacker to smuggle requests to the AJP server, where it forwards requests. CVE-2022-23943: An out-of-bounds read/write vulnerability was found in the mod_sed module of httpd. This flaw allows an attacker to overwrite the memory of an httpd instance that is using mod_sed with data provided by the attacker. CVE-2022-22721: A flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write. CVE-2022-22720: A flaw was found in httpd. The inbound connection is not closed when it fails to discard the request body, which may expose the server to HTTP request smuggling. CVE-2022-22719: A flaw was found in the mod_lua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The highest treat of this vulnerability is availability. CVE-2021-44790: A buffer overflow flaw in httpd's lua module could allow an out-of-bounds write. An attacker who is able to submit a crafted request to an httpd instance that is using the lua module may be able to cause an impact to confidentiality, integrity, and/or availability. CVE-2021-44224: There's a null pointer dereference and server-side request forgery flaw in httpd's mod_proxy module, when it is configured to be used as a forward proxy. A crafted packet could be sent on the adjacent network to the forward proxy that could cause a crash, or potentially SSRF via misdirected Unix Domain Socket requests. In the worst case, this could cause a denial of service or compromise to confidentiality of data.
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | httpd | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | httpd-core | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | httpd-core-debuginfo | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | httpd-debuginfo | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | httpd-debugsource | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | httpd-devel | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | httpd-filesystem | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | httpd-manual | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | httpd-tools | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | httpd-tools-debuginfo | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_ldap | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_ldap-debuginfo | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_lua | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_lua-debuginfo | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_proxy_html | 1:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_proxy_html-debuginfo | 1:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_session | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_session-debuginfo | 0:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_ssl | 1:2.4.54-3.amzn2023.0.4 |
| Amazon Linux · 2023 | mod_ssl-debuginfo | 1:2.4.54-3.amzn2023.0.4 |
Vulnerabilities 14
-
Critical 9.1
Read beyond bounds in ap_strcmp_match()
Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party…
-
Unscored —CVE-2021-44224 EPSS 82%
Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Soc…
-
Unscored —
Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue af…
-
Unscored —CVE-2022-22719 EPSS 70%
mod_lua Use of uninitialized value of in r:parsebody
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
-
Unscored —
HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
-
Unscored —CVE-2022-22721 EPSS 42%
core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
-
Unscored —
mod_sed: Read/write beyond bounds
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.
-
Unscored —
mod_proxy_ajp: Possible request smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Se…
-
Unscored —
read beyond bounds in mod_isapi
Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.
-
Unscored —
read beyond bounds via ap_rwrite()
The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distrib…
-
Unscored —
Denial of service in mod_lua r:parsebody
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
-
Unscored —CVE-2022-30522 EPSS 90%
mod_sed denial of service
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
-
Unscored —
Information Disclosure in mod_lua with websockets
Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
-
Unscored —CVE-2022-31813 Public exploit
mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-44224.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-44790.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-22719.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-22720.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-22721.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-23943.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-26377.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-28330.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-28614.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-28615.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-29404.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-30522.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-30556.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-31813.html