Apache HTTP Server 2.4.53 and earlier - Read Beyond Bounds Vulnerability (CVE-2022-28615)
Summary
CVE-2022-28615: Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. Affects apache2 across 2 version ranges.
< 2.4.54-r0
< 5ed6876d88a45356ea39ece729853fc9c9f37e2d
Fixed in 2.4.54-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software. It provides a secure and efficient platform for hosting websites and applications. The Apache HTTP Server version 2.4.53 and earlier are affected by a vulnerability that can lead to a crash or information disclosure. This vulnerability resides in the ap_strcmp_match() function, which can be triggered by providing an extremely large input buffer. While the server's own code cannot be coerced into triggering this vulnerability, third-party modules or Lua scripts that use ap_strcmp_match() may potentially be affected.
Vulnerability Detail
The vulnerability (CVE-2022-28615) in Apache HTTP Server 2.4.53 and earlier arises from a read beyond bounds issue in the ap_strcmp_match() function. When an excessively large input buffer is provided, it can cause the function to read beyond the intended bounds. This can result in a crash or information disclosure. Although the server's own code cannot be manipulated to trigger this vulnerability, it may impact third-party modules or Lua scripts that utilize ap_strcmp_match(). The potential consequences of this vulnerability include unauthorized access to sensitive information or a denial of service (DoS) condition.
How To Fix
Minimum fixed version
2.4.54-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As this vulnerability primarily affects third-party modules or Lua scripts, there is no specific workaround provided by the Apache HTTP Server project. However, it is advisable to review and update any third-party modules or Lua scripts used in conjunction with the server to ensure they are not vulnerable to this issue. Additionally, monitoring and restricting access to sensitive information can help mitigate the impact of a potential information disclosure.
Conclusion
The Apache HTTP Server version 2.4.53 and earlier are vulnerable to a read beyond bounds issue in the ap_strcmp_match() function. Upgrading to version 2.4.54 or later is recommended to mitigate this vulnerability. It is also important to review and update any third-party modules or Lua scripts used in conjunction with the server. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server is an open-source web server software widely used for hosting websites and applications.
Apache HTTP Server versions 2.4.53 and earlier are affected by this vulnerability.
This vulnerability can be exploited by providing an extremely large input buffer to the ap_strcmp_match() function, potentially leading to a crash or information disclosure.
No, the Apache HTTP Server code cannot be coerced into triggering this vulnerability. However, third-party modules or Lua scripts that use ap_strcmp_match() may be affected.
The potential consequences include unauthorized access to sensitive information or a denial of service (DoS) condition.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
