Integer Overflow Vulnerability in Apache HTTP Server
Summary
CVE-2022-22721: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. Affects apache2 versions < 2.4.53-r0. Fixed in 2.4.53-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that provides a robust and secure platform for hosting websites. It is known for its scalability, performance, and extensive feature set. However, a vulnerability has been discovered in versions 2.4.52 and earlier, which can lead to out of bounds writes due to an integer overflow when the LimitXMLRequestBody configuration is set to allow request bodies larger than 350MB on 32-bit systems.
Vulnerability Detail
The CVE-2022-22721 vulnerability in Apache HTTP Server arises from an integer overflow issue. When the LimitXMLRequestBody configuration is set to allow large request bodies on 32-bit systems, an integer overflow occurs, leading to out of bounds writes. This can be exploited by an attacker to execute arbitrary code or cause a denial of service. The vulnerability has a CVSS score of 9.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.4.53-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, a temporary workaround is to set the LimitXMLRequestBody configuration to a value lower than 350MB on 32-bit systems. This reduces the risk of triggering the integer overflow and mitigates the vulnerability. However, it is crucial to apply the official fix as soon as possible.
Conclusion
The CVE-2022-22721 vulnerability in Apache HTTP Server poses a significant risk to the security and stability of affected installations. It is crucial to update to version 2.4.53 or later to mitigate this vulnerability. If immediate upgrading is not possible, applying the temporary workaround of setting the LimitXMLRequestBody configuration to a lower value can reduce the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server is an open-source web server software widely used for hosting websites. It offers scalability, performance, and a comprehensive feature set.
The CVE-2022-22721 vulnerability is an integer overflow issue in Apache HTTP Server versions 2.4.52 and earlier. It can lead to out of bounds writes and potentially allow arbitrary code execution or denial of service.
Exploiting this vulnerability can result in arbitrary code execution or denial of service. It poses a significant risk to the security and stability of the affected Apache HTTP Server installations.
To fix this vulnerability, update Apache HTTP Server to version 2.4.53 or later. This update addresses the integer overflow issue and prevents out of bounds writes.
Yes, a temporary workaround is to set the LimitXMLRequestBody configuration to a value lower than 350MB on 32-bit systems. However, it is crucial to apply the official fix by upgrading to the latest version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
