Moderate: httpd:2.4 security update
Summary
ALSA-2022:7647: Moderate: httpd:2.4 security update. Affects httpd versions < 2.4.37-51.module_el8.7.0+3281+01e58653. Fixed in 2.4.37-51.module_el8.7.0+3281+01e58653. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. It is widely used to serve web content and handle HTTP requests. The vulnerability affects the httpd package in AlmaLinux 8.
Vulnerability Detail
The vulnerability in the httpd package includes multiple security issues:
- CVE-2022-23943: mod_sed allows read/write beyond bounds.
- CVE-2022-22719: mod_lua uses uninitialized value in r:parsebody.
- CVE-2022-22721: core has a possible buffer overflow with very large or unlimited LimitXMLRequestBody.
- CVE-2022-26377: mod_proxy_ajp allows possible request smuggling.
- CVE-2022-29404: mod_lua has a Denial of Service (DoS) vulnerability in r:parsebody.
- CVE-2022-30522: mod_sed has a DoS vulnerability.
- CVE-2022-31813: mod_proxy drops X-Forwarded-For by hop-by-hop mechanism.
- CVE-2022-28614: Out-of-bounds read via ap_rwrite().
- CVE-2022-28615: Out-of-bounds read in ap_strcmp_match().
- CVE-2022-30556: mod_lua has an information disclosure vulnerability with websockets.
These vulnerabilities can lead to various security issues, including remote code execution, denial of service, and information disclosure.
How To Fix
Minimum fixed version
2.4.37-51.module_el8.7.0+3281+01e58653
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for this vulnerability.
Conclusion
The httpd package in AlmaLinux 8 is affected by multiple security vulnerabilities. To mitigate the risks, it is recommended to update the package to the latest version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for httpd →
FAQ
These vulnerabilities can lead to remote code execution, denial of service, and information disclosure.
There is no information provided about known exploits for these vulnerabilities.
The vulnerability affects httpd versions prior to 2.4.37-51.module_el8.7.0+3281+01e58653 in AlmaLinux 8.
Yes, these vulnerabilities can be exploited remotely.
No specific CVSS scores are provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
