Critical Integer Overflow Vulnerability in Apache2 Package - CVE-2022-22721
Summary
ALPINE-CVE-2022-22721: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. Affects apache2 versions < 2.4.53-r0. Fixed in 2.4.53-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, power, and extensive feature set, making it a popular choice among developers and system administrators. However, certain configurations can expose it to vulnerabilities, such as the one identified in CVE-2022-22721, which affects versions 2.4.52 and earlier.
Vulnerability Detail
The vulnerability arises when the LimitXMLRequestBody directive is set to allow request bodies larger than 350MB on 32-bit systems. This configuration can lead to an integer overflow, resulting in out-of-bounds writes. Such a flaw can be exploited by attackers to execute arbitrary code, potentially compromising the server's integrity and availability. The vulnerability is particularly critical, with a CVSS score of 9.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.4.53-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider lowering the LimitXMLRequestBody directive to a value below 350MB or disabling it altogether if not needed. This can be done by adding the following line to your Apache configuration file: 'LimitXMLRequestBody 1048576' (which sets the limit to 1MB).
Conclusion
CVE-2022-22721 is a significant vulnerability affecting the Apache2 package, which can lead to severe security risks if not addressed. Users are strongly advised to update to the patched version and consider implementing workarounds to mitigate potential threats. Regular monitoring for vulnerabilities using tools like Vulert can enhance security posture.
See every vulnerability recorded for apache2 →
FAQ
CVE-2022-22721 is a critical vulnerability in the Apache HTTP Server that can lead to integer overflow and out-of-bounds writes when handling large request bodies.
You can check your Apache2 version using the command 'apache2 -v' and compare it against the patched version 2.4.53-r0.
Exploitation of this vulnerability can lead to arbitrary code execution, server crashes, and unauthorized access to sensitive data.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
