Apache HTTP Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• Critical 9.1
  CVE-2022-28615

  Read beyond bounds in ap_strcmp_match()

  Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 8, 2022
• Unscored —
  CVE-2022-26377 Public exploit EPSS 21%

  mod_proxy_ajp: Possible request smuggling

  Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Se…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 8, 2022
• Unscored —
  CVE-2022-28330

  read beyond bounds in mod_isapi

  Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.

  Apache Software Foundation Apache HTTP Server apache2 Alpine
  Jun 8, 2022
• Unscored —
  CVE-2022-28614

  read beyond bounds via ap_rwrite()

  The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distrib…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 8, 2022
• Unscored —
  CVE-2022-29404

  Denial of service in mod_lua r:parsebody

  In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 8, 2022
• Unscored —
  CVE-2022-30522 EPSS 90%

  mod_sed denial of service

  If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 8, 2022
• Unscored —
  CVE-2022-30556

  Information Disclosure in mod_lua with websockets

  Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 8, 2022
• Unscored —
  CVE-2022-31813 Public exploit

  mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism

  Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 8, 2022

Revision history

1. 2026-06-30 #34

   Neue Updates von SUSE aufgenommen

2. 2024-03-26 #33

   Neue Updates von IBM aufgenommen

3. 2023-10-31 #32

   Neue Updates von IBM aufgenommen

4. 2023-08-13 #31

   Neue Updates von HP aufgenommen

5. 2023-06-22 #30

   Neue Updates von F5 aufgenommen

6. 2023-04-10 #29

   Neue Updates von F5 aufgenommen

7. 2023-04-04 #28

   Neue Updates von Oracle Linux aufgenommen

8. 2023-02-16 #27

   Aktualisierung IBM Link wg. nicht mehr erreichbarer URL, Ergänzung Produktliste dazu

9. 2022-12-08 #26

   Neue Updates von Red Hat aufgenommen

10. 2022-11-21 #25

    Neue Updates von Oracle Linux aufgenommen

11. 2022-11-15 #24

    Neue Updates von Red Hat und Oracle Linux aufgenommen

12. 2022-11-08 #23

    Neue Updates von Red Hat aufgenommen

13. 2022-11-06 #22

    Neue Updates von Amazon aufgenommen

14. 2022-09-29 #21

    Neue Updates von Red Hat aufgenommen

15. 2022-09-27 #20

    Neue Updates von Baramundi aufgenommen

16. 2022-09-20 #19

    Neue Updates von HCL aufgenommen

17. 2022-08-17 #18

    Neue Updates von Oracle Linux aufgenommen

18. 2022-08-15 #17

    Neue Updates von QNAP aufgenommen

19. 2022-08-14 #16

    Neue Updates von Gentoo aufgenommen

20. 2022-08-10 #15

    Neue Updates von Oracle Linux aufgenommen

21. 2022-08-07 #14

    Neue Updates von Oracle Linux aufgenommen

22. 2022-08-04 #13

    Neue Updates von Oracle Linux aufgenommen

23. 2022-07-27 #12

    Neue Updates von NetApp aufgenommen

24. 2022-07-21 #11

    Neue Updates von Amazon aufgenommen

25. 2022-07-14 #10

    Neue Updates von Amazon aufgenommen

References

• Apache Security Advisory vom 2022-06-07
  https://httpd.apache.org/security/vulnerabilities_24.html#2.4.54
• SUSE Security Update SUSE-SU-2022:2099-1 vom 2022-06-16
  https://lists.suse.com/pipermail/sle-security-updates/2022-June/011297.html
• SUSE Security Update SUSE-SU-2022:2101-1 vom 2022-06-16
  https://lists.suse.com/pipermail/sle-security-updates/2022-June/011298.html
• IBM Security Bulletin 6595149 vom 2022-06-16
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-http-server-used-by-ibm-websphere-application-server-2/
• Ubuntu Security Notice USN-5487-1 vom 2022-06-21
  https://ubuntu.com/security/notices/USN-5487-1
• Ubuntu Security Notice USN-5487-2 vom 2022-06-23
  https://ubuntu.com/security/notices/USN-5487-2
• Ubuntu Security Notice USN-5487-3 vom 2022-06-24
  https://ubuntu.com/security/notices/USN-5487-3
• F5 Security Advisory K58003591 vom 2022-07-05
  https://support.f5.com/csp/article/K58003591
• SUSE Security Update SUSE-SU-2022:2302-1 vom 2022-07-06
  https://lists.suse.com/pipermail/sle-security-updates/2022-July/011423.html
• Amazon Linux Security Advisory ALAS-2022-1607 vom 2022-07-07
  https://alas.aws.amazon.com/ALAS-2022-1607.html
• SUSE Security Update SUSE-SU-2022:2342-1 vom 2022-07-08
  https://lists.suse.com/pipermail/sle-security-updates/2022-July/011488.html
• SUSE Security Update SUSE-SU-2022:2338-1 vom 2022-07-08
  https://lists.suse.com/pipermail/sle-security-updates/2022-July/011487.html
• F5 Security Advisory K40582331 vom 2022-07-08
  https://support.f5.com/csp/article/K40582331
• Amazon Linux Security Advisory ALAS-2022-1812 vom 2022-07-15
  https://alas.aws.amazon.com/AL2/ALAS-2022-1812.html
• Amazon Linux Security Advisory ALAS-2022-110 vom 2022-07-21
  https://alas.aws.amazon.com/AL2022/ALAS-2022-110.html
• NetApp Security Advisory NTAP-20220624-0005 vom 2022-07-27
  https://security.netapp.com/advisory/ntap-20220624-0005/
• Oracle Linux Security Advisory ELSA-2022-9675 vom 2022-08-04
  http://linux.oracle.com/errata/ELSA-2022-9675.html
• Oracle Linux Security Advisory ELSA-2022-9676 vom 2022-08-04
  http://linux.oracle.com/errata/ELSA-2022-9676.html
• Oracle Linux Security Advisory ELSA-2022-9680 vom 2022-08-05
  http://linux.oracle.com/errata/ELSA-2022-9680.html
• Oracle Linux Security Advisory ELSA-2022-9682 vom 2022-08-11
  https://linux.oracle.com/errata/ELSA-2022-9682.html
• Gentoo Linux Security Advisory GLSA-202208-20 vom 2022-08-14
  https://security.gentoo.org/glsa/202208-20
• QNAP Security Advisory QSA-22-23 vom 2022-08-15
  https://www.qnap.com/de-de/security-advisory/QSA-22-23
• Oracle Linux Security Advisory ELSA-2022-9714 vom 2022-08-17
  http://linux.oracle.com/errata/ELSA-2022-9714.html
• HCL Article KB0100505 vom 2022-09-21
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100505
• baramundi Sicherheitsupdate S-2022-01 vom 2022-09-27
  https://www.baramundi.com/de-de/security-info/s-2022-01/
• Red Hat Security Advisory RHSA-2022:6753 vom 2022-09-29
  https://access.redhat.com/errata/RHSA-2022:6753
• Amazon Linux Security Advisory ALAS-2022-202 vom 2022-11-04
  https://alas.aws.amazon.com/AL2022/ALAS-2022-202.html
• Red Hat Security Advisory RHSA-2022:7647 vom 2022-11-08
  https://access.redhat.com/errata/RHSA-2022:7647
• Red Hat Security Advisory RHSA-2022:8067 vom 2022-11-15
  https://access.redhat.com/errata/RHSA-2022:8067
• Oracle Linux Security Advisory ELSA-2022-7647 vom 2022-11-15
  https://linux.oracle.com/errata/ELSA-2022-7647.html
• Oracle Linux Security Advisory ELSA-2022-8067 vom 2022-11-22
  https://linux.oracle.com/errata/ELSA-2022-8067.html
• Red Hat Security Advisory RHSA-2022:8840 vom 2022-12-08
  https://access.redhat.com/errata/RHSA-2022:8840
• Red Hat Security Advisory RHSA-2022:8841 vom 2022-12-08
  https://access.redhat.com/errata/RHSA-2022:8841
• IBM Security Bulletin 6595149 abgerufen am 2023-02-17
  https://www.ibm.com/support/pages/node/6595149
• Oracle Linux Security Advisory ELSA-2023-1593 vom 2023-04-05
  https://linux.oracle.com/errata/ELSA-2023-1593.html
• F5 Security Advisory K26314875 vom 2023-04-06
  https://my.f5.com/manage/s/article/K26314875
• F5 Security Advisory K40582331 vom 2023-06-22
  https://my.f5.com/manage/s/article/K40582331
• HPE Securi+y Bulletin
  https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-hpesbst04494en_us
• IBM Security Bulletin 7063718 vom 2023-10-31
  https://www.ibm.com/support/pages/node/7063718
• IBM Security Bulletin 7145265 vom 2024-03-26
  https://www.ibm.com/support/pages/node/7145265
• SUSE Security Update SUSE-SU-2026:2686-1 vom 2026-06-30
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027074.html