Apache HTTP Server 2.4.53 and earlier - Unintended Memory Read
Summary
CVE-2022-28614: The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts()... Affects apache2 across 2 version ranges.
< 2.4.54-r0
< 4654faee107e0c3a830c204a1dc94700705e8e86
Fixed in 2.4.54-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software. It provides a reliable and scalable platform for hosting websites and applications. The server handles incoming requests and serves the requested content to clients. However, versions 2.4.53 and earlier of Apache HTTP Server are vulnerable to an unintended memory read issue.
Vulnerability Detail
The vulnerability (CVE-2022-28614) arises from the ap_rwrite() function in Apache HTTP Server. If an attacker can manipulate the server to reflect very large input using ap_rwrite() or ap_rputs(), they can trigger the server to read unintended memory. This can occur when modules compiled separately from Apache HTTP Server use the 'ap_rputs' function and pass it a very large string. The issue can be resolved by compiling these modules against the current headers.
How To Fix
Minimum fixed version
2.4.54-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
Conclusion
The vulnerability in Apache HTTP Server 2.4.53 and earlier allows an attacker to read unintended memory. To mitigate this issue, it is crucial to update to version 2.4.54-r0 or later and recompile any separately compiled modules against the updated headers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server is an open-source web server software widely used for hosting websites and applications.
The vulnerability allows an attacker to read unintended memory, which could potentially lead to information disclosure or other security issues.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Apache HTTP Server version is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
Yes, updating Apache HTTP Server to version 2.4.54-r0 or later resolves this vulnerability. Additionally, modules compiled separately from Apache HTTP Server should be recompiled against the updated headers.
You can find more information about this vulnerability in the CVE-2022-28614 JSON report available at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28614.json
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
