Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 security update

Fixed packages 44

Vulnerabilities 9

• Critical 9.8
  CVE-2022-24963

  Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions

  Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.

  Apache Software Foundation Apache Portable Runtime (APR) apr apr Debian Ubuntu Azure Linux Alpine
  Jan 31, 2023
• Critical 9.0
  CVE-2022-36760

  Apache HTTP Server: mod_proxy_ajp Possible request smuggling

  Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Se…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jan 17, 2023
• High 7.5
  CVE-2022-48279

  In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the …

  modsecurity modsecurity modsecurity-apache mod_security Debian Ubuntu Azure Linux
  Jan 20, 2023
• High 7.5
  CVE-2023-24021

  Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall byp…

  modsecurity-apache mod_security modsecurity-apache Debian Ubuntu Azure Linux
  Jan 20, 2023
• High 7.5
  CVE-2023-27522

  Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

  HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine PyPI
  Mar 7, 2023
• High 7.5
  CVE-2023-28319

  A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's pub…

  mysql curl curl rust Debian Azure Linux Alpine
  May 26, 2023
• Medium 5.9
  CVE-2023-28321

  An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard pat…

  mysql curl curl curl Debian Ubuntu Azure Linux Alpine
  May 26, 2023
• Medium 5.3
  CVE-2022-37436 EPSS 53%

  Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting

  Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by …

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jan 17, 2023
• Medium 5.3
  CVE-2023-28322

  An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …

  curl curl curl tensorflow Debian Ubuntu Azure Linux Alpine
  May 26, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161773
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161777
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2163615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2163622
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2169465
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2176211
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196778
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196786
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2196793
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4629.json
• report
  https://access.redhat.com/security/cve/CVE-2022-24963
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-24963
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-24963
• article
  https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9
• report
  https://access.redhat.com/security/cve/CVE-2022-36760
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-36760
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-36760
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-36760
• report
  https://access.redhat.com/security/cve/CVE-2022-37436
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-37436
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-37436
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-37436
• report
  https://access.redhat.com/security/cve/CVE-2022-48279
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48279
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48279
• report
  https://access.redhat.com/security/cve/CVE-2023-24021
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-24021
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-24021
• report
  https://access.redhat.com/security/cve/CVE-2023-27522
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-27522
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-27522
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2023-28319
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28319
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-28319
• article
  https://curl.se/docs/CVE-2023-28319.html
• report
  https://access.redhat.com/security/cve/CVE-2023-28321
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28321