Apache HTTP Server 2.4.53 - Excessive Memory Allocation Vulnerability
Summary
CVE-2022-30522: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Affects apache2 across 2 version ranges.
< 2.4.54-r0
< 4654faee107e0c3a830c204a1dc94700705e8e86
Fixed in 2.4.54-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache HTTP Server is a widely used open-source web server software. It provides a reliable and efficient platform for hosting websites and applications. The mod_sed module in Apache HTTP Server allows for transformations on incoming requests, which can be useful for various purposes such as rewriting URLs or modifying content. However, in certain contexts where the input to mod_sed is very large, a vulnerability exists that can lead to excessive memory allocations and trigger an abort in the server.
Vulnerability Detail
The vulnerability (CVE-2022-30522) in Apache HTTP Server 2.4.53 arises when mod_sed is configured to perform transformations on large inputs. This can result in the server making excessively large memory allocations, potentially leading to resource exhaustion and a denial-of-service condition. An attacker could exploit this vulnerability by sending specially crafted requests that trigger the mod_sed transformation in a vulnerable configuration. Successful exploitation could cause the server to crash or become unresponsive, impacting the availability of the web service.
How To Fix
Minimum fixed version
2.4.54-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Apache HTTP Server is not immediately feasible, a possible workaround is to disable or limit the usage of mod_sed in the server configuration. By removing or restricting the mod_sed module, the vulnerability can be mitigated. However, this workaround may impact any functionality or transformations relying on mod_sed, so it is recommended to thoroughly test the server behavior after applying this workaround.
Conclusion
The Apache HTTP Server 2.4.53 excessive memory allocation vulnerability in mod_sed can be mitigated by upgrading to version 2.4.54-r0 or later. Alternatively, users can apply a workaround by disabling or limiting the usage of mod_sed. It is important to promptly address this vulnerability to ensure the stability and availability of the web server. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server is an open-source web server software widely used for hosting websites and applications.
mod_sed is a module in Apache HTTP Server that allows for transformations on incoming requests, such as URL rewriting or content modification.
The vulnerability can lead to excessive memory allocations and resource exhaustion, potentially causing the server to crash or become unresponsive.
Upgrade Apache HTTP Server to version 2.4.54-r0 or later, which includes a fix for the excessive memory allocation issue in mod_sed.
A possible workaround is to disable or limit the usage of mod_sed in the server configuration, but this may impact functionality relying on mod_sed.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
