-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: httpd:2.4 security update
Advisory ID:       RHSA-2022:7647-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:7647
Issue date:        2022-11-08
CVE Names:         CVE-2022-22719 CVE-2022-22721 CVE-2022-23943 
                   CVE-2022-26377 CVE-2022-28614 CVE-2022-28615 
                   CVE-2022-29404 CVE-2022-30522 CVE-2022-30556 
                   CVE-2022-31813 
====================================================================
1. Summary:

An update for the httpd:2.4 module is now available for Red Hat Enterprise
Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

The httpd packages provide the Apache HTTP Server, a powerful, efficient,
and extensible web server.

Security Fix(es):

* httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)

* httpd: mod_lua: Use of uninitialized value of in r:parsebody
(CVE-2022-22719)

* httpd: core: Possible buffer overflow with very large or unlimited
LimitXMLRequestBody (CVE-2022-22721)

* httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)

* httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)

* httpd: mod_sed: DoS vulnerability (CVE-2022-30522)

* httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism
(CVE-2022-31813)

* httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)

* httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)

* httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.7 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted
automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

2064319 - CVE-2022-23943 httpd: mod_sed: Read/write beyond bounds
2064320 - CVE-2022-22721 httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
2064322 - CVE-2022-22719 httpd: mod_lua: Use of uninitialized value of in r:parsebody
2094997 - CVE-2022-26377 httpd: mod_proxy_ajp: Possible request smuggling
2095002 - CVE-2022-28614 httpd: Out-of-bounds read via ap_rwrite()
2095006 - CVE-2022-28615 httpd: Out-of-bounds read in ap_strcmp_match()
2095012 - CVE-2022-29404 httpd: mod_lua: DoS in r:parsebody
2095015 - CVE-2022-30522 httpd: mod_sed: DoS vulnerability
2095018 - CVE-2022-30556 httpd: mod_lua: Information disclosure with websockets
2095020 - CVE-2022-31813 httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.src.rpm
mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.src.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.src.rpm

aarch64:
httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
httpd-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
httpd-debugsource-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
httpd-devel-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
httpd-tools-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
httpd-tools-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.aarch64.rpm
mod_http2-debuginfo-1.15.7-5.module+el8.6.0+13996+01710940.aarch64.rpm
mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.aarch64.rpm
mod_ldap-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
mod_ldap-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm
mod_proxy_html-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
mod_proxy_html-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
mod_session-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
mod_session-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
mod_ssl-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
mod_ssl-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm

noarch:
httpd-filesystem-2.4.37-51.module+el8.7.0+16050+02173b8e.noarch.rpm
httpd-manual-2.4.37-51.module+el8.7.0+16050+02173b8e.noarch.rpm

ppc64le:
httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
httpd-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
httpd-debugsource-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
httpd-devel-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
httpd-tools-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
httpd-tools-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.ppc64le.rpm
mod_http2-debuginfo-1.15.7-5.module+el8.6.0+13996+01710940.ppc64le.rpm
mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.ppc64le.rpm
mod_ldap-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
mod_ldap-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm
mod_proxy_html-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
mod_proxy_html-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
mod_session-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
mod_session-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
mod_ssl-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
mod_ssl-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm

s390x:
httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
httpd-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
httpd-debugsource-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
httpd-devel-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
httpd-tools-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
httpd-tools-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.s390x.rpm
mod_http2-debuginfo-1.15.7-5.module+el8.6.0+13996+01710940.s390x.rpm
mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.s390x.rpm
mod_ldap-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
mod_ldap-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm
mod_proxy_html-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
mod_proxy_html-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
mod_session-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
mod_session-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
mod_ssl-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
mod_ssl-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm

x86_64:
httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
httpd-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
httpd-debugsource-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
httpd-devel-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
httpd-tools-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
httpd-tools-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpm
mod_http2-debuginfo-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpm
mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpm
mod_ldap-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
mod_ldap-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
mod_proxy_html-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
mod_proxy_html-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
mod_session-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
mod_session-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
mod_ssl-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
mod_ssl-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-22719
https://access.redhat.com/security/cve/CVE-2022-22721
https://access.redhat.com/security/cve/CVE-2022-23943
https://access.redhat.com/security/cve/CVE-2022-26377
https://access.redhat.com/security/cve/CVE-2022-28614
https://access.redhat.com/security/cve/CVE-2022-28615
https://access.redhat.com/security/cve/CVE-2022-29404
https://access.redhat.com/security/cve/CVE-2022-30522
https://access.redhat.com/security/cve/CVE-2022-30556
https://access.redhat.com/security/cve/CVE-2022-31813
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY2pSVdzjgjWX9erEAQjeQQ/9HLdj+CQQi/1gKtbOj+m9kscI7Mqeb/7S
7N/UEFvrH/HI5SEcL8QIIvE/OweXHJHK6/njUOOTdO4fHjWJ9ZxbMCxCBMdqQhrn
YHPB//XGIHy0Myo5+iXcOdpKiIlZTubrNTXglyriKf7UJTWKtYb71t5xwLQV9U5T
2zbGrGpkVwU20N3Oy4mHHQs7nvuqb21waxwpr54gIVzMkfQnYc5d9rLYwsrddZEi
dPeqH2AVHAU7TvwNPjKrZudC2X0k3p4r/sYu3Tksp7C2Qo10/x7ekcFYEqZfhYcK
xsyEq0qqVYM1v7SC8MTCmFp9nx1zuHzAcH3r2kXwtG3dSXiHmA3/HYen8k8qFM8L
fX/XH9lVckvpruoGi4I5bsS0plO1IuOz70MFVh+ImgtrCzvDH/tNxHA/0tKlDDao
lvIg9KOKlH/y/J1SofUP26Pfcyhwo4gZdjOYCghsWtLIWEYgcawZn3ooPM//xA5w
Lb5/cSDlmEv6MnG8tbJ9IGsG9W15/A9Jqoyx+TEXyXRpBjqT9/ElvA88UA8uciKJ
ZoHYmhJgn9C5dxnmweuCvXS+CnJaK8qgQ5lJy6OjeLgP2b7AB73TqEcuIJm2izvX
wbJYUElIU9QDHihmK8c3qjiW4Kr0Bz5H56U6in6DKLuAKXqH2NpdHFOihDOg7Uzv
muAF//BBtP4=x6q/
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-7647:01 Moderate: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8

Summary

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)
* httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719)
* httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)
* httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)
* httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)
* httpd: mod_sed: DoS vulnerability (CVE-2022-30522)
* httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)
* httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)
* httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)
* httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes linked from the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted automatically.

References

https://access.redhat.com/security/cve/CVE-2022-22719 https://access.redhat.com/security/cve/CVE-2022-22721 https://access.redhat.com/security/cve/CVE-2022-23943 https://access.redhat.com/security/cve/CVE-2022-26377 https://access.redhat.com/security/cve/CVE-2022-28614 https://access.redhat.com/security/cve/CVE-2022-28615 https://access.redhat.com/security/cve/CVE-2022-29404 https://access.redhat.com/security/cve/CVE-2022-30522 https://access.redhat.com/security/cve/CVE-2022-30556 https://access.redhat.com/security/cve/CVE-2022-31813 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.src.rpm mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.src.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.src.rpm
aarch64: httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm httpd-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm httpd-debugsource-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm httpd-devel-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm httpd-tools-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm httpd-tools-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.aarch64.rpm mod_http2-debuginfo-1.15.7-5.module+el8.6.0+13996+01710940.aarch64.rpm mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.aarch64.rpm mod_ldap-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm mod_ldap-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm mod_proxy_html-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm mod_proxy_html-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm mod_session-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm mod_session-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm mod_ssl-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm mod_ssl-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.aarch64.rpm
noarch: httpd-filesystem-2.4.37-51.module+el8.7.0+16050+02173b8e.noarch.rpm httpd-manual-2.4.37-51.module+el8.7.0+16050+02173b8e.noarch.rpm
ppc64le: httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm httpd-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm httpd-debugsource-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm httpd-devel-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm httpd-tools-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm httpd-tools-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.ppc64le.rpm mod_http2-debuginfo-1.15.7-5.module+el8.6.0+13996+01710940.ppc64le.rpm mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.ppc64le.rpm mod_ldap-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm mod_ldap-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm mod_proxy_html-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm mod_proxy_html-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm mod_session-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm mod_session-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm mod_ssl-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm mod_ssl-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.ppc64le.rpm
s390x: httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm httpd-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm httpd-debugsource-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm httpd-devel-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm httpd-tools-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm httpd-tools-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.s390x.rpm mod_http2-debuginfo-1.15.7-5.module+el8.6.0+13996+01710940.s390x.rpm mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.s390x.rpm mod_ldap-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm mod_ldap-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm mod_proxy_html-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm mod_proxy_html-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm mod_session-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm mod_session-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm mod_ssl-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm mod_ssl-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.s390x.rpm
x86_64: httpd-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm httpd-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm httpd-debugsource-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm httpd-devel-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm httpd-tools-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm httpd-tools-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm mod_http2-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpm mod_http2-debuginfo-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpm mod_http2-debugsource-1.15.7-5.module+el8.6.0+13996+01710940.x86_64.rpm mod_ldap-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm mod_ldap-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm mod_proxy_html-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm mod_proxy_html-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm mod_session-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm mod_session-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm mod_ssl-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm mod_ssl-debuginfo-2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2022:7647-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:7647
Issued Date: : 2022-11-08
CVE Names: CVE-2022-22719 CVE-2022-22721 CVE-2022-23943 CVE-2022-26377 CVE-2022-28614 CVE-2022-28615 CVE-2022-29404 CVE-2022-30522 CVE-2022-30556 CVE-2022-31813

Topic

An update for the httpd:2.4 module is now available for Red Hat EnterpriseLinux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64


Bugs Fixed

2064319 - CVE-2022-23943 httpd: mod_sed: Read/write beyond bounds

2064320 - CVE-2022-22721 httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

2064322 - CVE-2022-22719 httpd: mod_lua: Use of uninitialized value of in r:parsebody

2094997 - CVE-2022-26377 httpd: mod_proxy_ajp: Possible request smuggling

2095002 - CVE-2022-28614 httpd: Out-of-bounds read via ap_rwrite()

2095006 - CVE-2022-28615 httpd: Out-of-bounds read in ap_strcmp_match()

2095012 - CVE-2022-29404 httpd: mod_lua: DoS in r:parsebody

2095015 - CVE-2022-30522 httpd: mod_sed: DoS vulnerability

2095018 - CVE-2022-30556 httpd: mod_lua: Information disclosure with websockets

2095020 - CVE-2022-31813 httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism


Related News

Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered
Open Source Strategies for Enhancing Security in Digital Business Operations
5 - 9 min read
Digital transformation, powered by the principles of open-source security , is vital for businesses looking to excel in today's technology-driven
Microsoft Update Mayhem: Rescuing Linux Dual-Boot Systems from Secure Boot Woes
2 - 4 min read
Microsoft's recent patch, intended to strengthen Secure Boot defenses, has resulted in an unexpected setback for Linux-Windows dual-boot setups

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved