ALSA-2022:7647 — Moderate: httpd:2.4 security update

Summary

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)
* httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719)
* httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)
* httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)
* httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)
* httpd: mod_sed: DoS vulnerability (CVE-2022-30522)
* httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)
* httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)
* httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)
* httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 13

Release	Package	Fixed in
AlmaLinux · 8	httpd	2.4.37-51.module_el8.7.0+3281+01e58653
AlmaLinux · 8	httpd-devel	2.4.37-51.module_el8.7.0+3281+01e58653
AlmaLinux · 8	httpd-filesystem	2.4.37-51.module_el8.7.0+3281+01e58653
AlmaLinux · 8	httpd-manual	2.4.37-51.module_el8.7.0+3281+01e58653
AlmaLinux · 8	httpd-tools	2.4.37-51.module_el8.7.0+3281+01e58653
AlmaLinux · 8	mod_http2	1.15.7-5.module_el8.6.0+2872+fe0ff7aa
AlmaLinux · 8	mod_http2	1.15.7-5.module_el8.6.0+3031+fb177b09
AlmaLinux · 8	mod_ldap	2.4.37-51.module_el8.7.0+3281+01e58653
AlmaLinux · 8	mod_md	1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
AlmaLinux · 8	mod_md	1:2.0.8-8.module_el8.6.0+3031+fb177b09
AlmaLinux · 8	mod_proxy_html	1:2.4.37-51.module_el8.7.0+3281+01e58653
AlmaLinux · 8	mod_session	2.4.37-51.module_el8.7.0+3281+01e58653
AlmaLinux · 8	mod_ssl	1:2.4.37-51.module_el8.7.0+3281+01e58653

Vulnerabilities 10

Critical 9.1

CVE-2022-28615

Read beyond bounds in ap_strcmp_match()

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 8, 2022
Unscored —

CVE-2022-22719 EPSS 70%

mod_lua Use of uninitialized value of in r:parsebody

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Mar 14, 2022
Unscored —

CVE-2022-22721 EPSS 42%

core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Mar 14, 2022
Unscored —

CVE-2022-23943 Public exploit EPSS 50%

mod_sed: Read/write beyond bounds

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Mar 14, 2022
Unscored —

CVE-2022-26377 Public exploit EPSS 21%

mod_proxy_ajp: Possible request smuggling

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Se…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 8, 2022
Unscored —

CVE-2022-28614

read beyond bounds via ap_rwrite()

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distrib…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 8, 2022
Unscored —

CVE-2022-29404

Denial of service in mod_lua r:parsebody

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 8, 2022
Unscored —

CVE-2022-30522 EPSS 90%

mod_sed denial of service

If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 8, 2022
Unscored —

CVE-2022-30556

Information Disclosure in mod_lua with websockets

Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 8, 2022
Unscored —

CVE-2022-31813 Public exploit

mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 8, 2022

References

report
https://access.redhat.com/security/cve/CVE-2022-22719
report
https://access.redhat.com/security/cve/CVE-2022-22721
report
https://access.redhat.com/security/cve/CVE-2022-23943
report
https://access.redhat.com/security/cve/CVE-2022-26377
report
https://access.redhat.com/security/cve/CVE-2022-28614
report
https://access.redhat.com/security/cve/CVE-2022-28615
report
https://access.redhat.com/security/cve/CVE-2022-29404
report
https://access.redhat.com/security/cve/CVE-2022-30522
report
https://access.redhat.com/security/cve/CVE-2022-30556
report
https://access.redhat.com/security/cve/CVE-2022-31813
report
https://bugzilla.redhat.com/2064319
report
https://bugzilla.redhat.com/2064320
report
https://bugzilla.redhat.com/2064322
report
https://bugzilla.redhat.com/2094997
report
https://bugzilla.redhat.com/2095002
report
https://bugzilla.redhat.com/2095006
report
https://bugzilla.redhat.com/2095012
report
https://bugzilla.redhat.com/2095015
report
https://bugzilla.redhat.com/2095018
report
https://bugzilla.redhat.com/2095020
advisory
https://errata.almalinux.org/8/ALSA-2022-7647.html

Moderate: httpd:2.4 security update

Summary

Fixed packages 13

Vulnerabilities 10

Read beyond bounds in ap_strcmp_match()

mod_lua Use of uninitialized value of in r:parsebody

core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

mod_sed: Read/write beyond bounds

mod_proxy_ajp: Possible request smuggling

read beyond bounds via ap_rwrite()

Denial of service in mod_lua r:parsebody

mod_sed denial of service

Information Disclosure in mod_lua with websockets

mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism

References