Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Mageia 8 MGASA-2022-0228: Apache Request Smuggling Attack Risk

mageia
Calendar Grey June 13, 2022
Dist Mageia Esm H88
Recent updates to Apache packages address a significant request smuggling vulnerability present in all versions prior to 2.4.53, which has implications for Mageia 8 users.
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP serve...

Summary

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. (CVE-2022-26377) Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. (CVE-2022-28615) In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. (CVE-2022-29404) Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of ...

References

- https://bugs.mageia.org/show_bug.cgi?id=30529

- - https://httpd.apache.org/security/vulnerabilities_24.html

- https://www.cve.org/CVERecord?id=CVE-2022-26377

- https://www.cve.org/CVERecord?id=CVE-2022-28615

- https://www.cve.org/CVERecord?id=CVE-2022-29404

- https://www.cve.org/CVERecord?id=CVE-2022-30556

- https://www.cve.org/CVERecord?id=CVE-2022-31813

Topics%20covered

Topics Covered

security advisory denial of service apache attack information disclosure request smuggling mageia

Resolution

SRPMS

- 8/core/apache-2.4.54-1.mga8

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 13 Jun 2022
URL: https://advisories.mageia.org/MGASA-2022-0228.html
Type: security
CVE: CVE-2022-26377, CVE-2022-28615, CVE-2022-29404, CVE-2022-30556, CVE-2022-31813

Topics%20covered

Topics Covered

security advisory denial of service apache attack information disclosure request smuggling mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here