Buffer Overflow Vulnerability in Lighttpd Package: CVE-2022-22707
Summary
ALPINE-CVE-2022-22707: In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash... Affects lighttpd versions < 1.4.64-r0. Fixed in 1.4.64-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lighttpd is a lightweight web server designed for high-performance environments. It is known for its speed and efficiency, making it a popular choice for serving static and dynamic content. However, certain configurations of Lighttpd can expose it to vulnerabilities, such as the one identified in CVE-2022-22707, which affects versions 1.4.46 through 1.4.63.
Vulnerability Detail
The vulnerability arises from a stack-based buffer overflow in the mod_extforward_Forwarded function of the mod_extforward plugin. This flaw can lead to a remote denial of service, causing the daemon to crash under specific non-default configurations that handle the Forwarded header unusually. The risk is notably higher on 32-bit systems compared to 64-bit systems, potentially impacting server availability and reliability.
How To Fix
Minimum fixed version
1.4.64-r0
This is the first release that contains the fix.
sudo apk add --upgrade lighttpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the mod_extforward plugin or avoiding the use of the Forwarded header in your configurations to mitigate the risk of exploitation.
Conclusion
CVE-2022-22707 represents a significant vulnerability in the Lighttpd web server that can lead to service disruptions. It is crucial for users to update to the patched version to ensure their systems remain secure. For those unable to update immediately, implementing workarounds can help mitigate the risks.
See every vulnerability recorded for lighttpd →
FAQ
CVE-2022-22707 is a vulnerability in the Lighttpd web server that can lead to a buffer overflow and potential denial of service.
The vulnerability affects Lighttpd versions 1.4.46 through 1.4.63.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
As a temporary measure, you can disable the mod_extforward plugin or avoid using the Forwarded header in your configurations.
The CVSS score for CVE-2022-22707 is 5.9, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for lighttpd.
