Apache HTTP Server 2.4.53 - Out-of-Bounds Read Vulnerability
Summary
CVE-2022-28330: Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Affects apache2 across 2 version ranges.
< 2.4.54-r0
< 4654faee107e0c3a830c204a1dc94700705e8e86
Fixed in 2.4.54-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software. It provides a reliable and efficient platform for serving web content. The mod_isapi module in Apache HTTP Server versions 2.4.53 and earlier on Windows is vulnerable to an out-of-bounds read issue. This vulnerability can be exploited by an attacker to read beyond the bounds of a request, potentially leading to information disclosure or a denial of service.
Vulnerability Detail
The vulnerability (CVE-2022-28330) exists in the mod_isapi module of Apache HTTP Server. When configured to process requests, the server may read beyond the intended bounds. This can occur due to a flaw in the module's request processing logic. An attacker can exploit this vulnerability by sending a specially crafted request to the server. Successful exploitation could result in the disclosure of sensitive information or a denial of service.
How To Fix
Minimum fixed version
2.4.54-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is strongly advised to apply the official patch or upgrade to a fixed version of Apache HTTP Server.
Conclusion
The Apache HTTP Server 2.4.53 and earlier versions on Windows are vulnerable to an out-of-bounds read issue in the mod_isapi module. This vulnerability can be exploited to disclose sensitive information or cause a denial of service. Users are advised to upgrade to Apache HTTP Server version 2.4.54 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server is an open-source web server software that provides a reliable platform for serving web content.
The mod_isapi module is a component of Apache HTTP Server that enables the server to process requests using the ISAPI (Internet Server Application Programming Interface) protocol.
An attacker can exploit this vulnerability by sending a specially crafted request to the server, causing it to read beyond the intended bounds and potentially disclose sensitive information or cause a denial of service.
Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a denial of service.
To mitigate the risk of exploitation, it is recommended to upgrade Apache HTTP Server to version 2.4.54 or later.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
