Apache HTTP Server Vulnerability: Excessive Memory Allocation in mod_sed
Summary
UBUNTU-CVE-2022-30522: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Affects apache2 versions < 2.4.7-1ubuntu4.22+esm8. Fixed in 2.4.7-1ubuntu4.22+esm8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, power, and extensive features, including support for various modules that enhance its functionality. However, a vulnerability has been identified in version 2.4.53 related to the mod_sed module, which can lead to excessive memory allocation under certain configurations, potentially causing server crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2022-30522, arises when Apache HTTP Server 2.4.53 is configured to perform transformations using mod_sed in contexts where the input may be very large. This can lead to excessively large memory allocations, ultimately triggering an abort of the server process. The implications of this vulnerability include potential denial of service, where legitimate users may be unable to access the server due to crashes caused by this memory issue.
How To Fix
Minimum fixed version
2.4.7-1ubuntu4.22+esm8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling mod_sed or limiting the size of inputs processed by it to prevent excessive memory allocation. This can be done by adjusting the server configuration to restrict the contexts in which mod_sed is applied.
Conclusion
The vulnerability CVE-2022-30522 in Apache HTTP Server poses a significant risk due to excessive memory allocation in mod_sed, leading to potential server crashes. Users are advised to update to the latest patched version to ensure their systems remain secure. For those unable to update immediately, temporary workarounds are available to mitigate risks.
See every vulnerability recorded for apache2 →
FAQ
CVE-2022-30522 is a vulnerability in Apache HTTP Server that allows for excessive memory allocation when using the mod_sed module with large inputs, potentially leading to server crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The primary consequence is a denial of service, where the server may crash due to excessive memory usage, affecting all users trying to access the service.
Yes, a patched version of Apache HTTP Server is available. Users should update to version 2.4.53 or later to mitigate the vulnerability.
If immediate updating is not possible, consider disabling mod_sed or limiting input sizes to reduce the risk of triggering the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
