Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 510
Alerts This Week
Warning Icon 1 510

Ubuntu 18.04 LTS: USN-5487-3 Critical: Apache HTTP Server Regression Issues

ubuntu
Calendar Grey June 23, 2022
Dist Ubuntu Esm H88
Essential patch for Nginx Web Server to resolve issues and enhance security vulnerabilities on Ubuntu platforms. Take immediate action!
USN-5487-1 introduced a regression in Apache HTTP Server.

Summary

USN-5487-1 introduced a regression in Apache HTTP Server.

Software Description:

- apache2: Apache HTTP server

Details:

USN-5487-1 fixed several vulnerabilities in Apache HTTP Server.

Unfortunately it caused regressions. USN-5487-2 reverted the

patches that caused the regression in Ubuntu 14.04 ESM for further

investigation. This update re-adds the security fixes for Ubuntu

14.04 ESM and fixes two different regressions: one affecting mod_proxy

only in Ubuntu 14.04 ESM and another in mod_sed affecting also Ubuntu 16.04 ESM

and Ubuntu 18.04 LTS.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Apache HTTP Server mod_proxy_ajp incorrectly handled

certain crafted request. A remote attacker could possibly use this issue to

perform an HTTP Request Smuggling attack. (CVE-2022-26377)

It was discovered that Apache HTTP Server incorrectly handled certain

request. An attacker could possibly use this issue to cause a den...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service remote code execution ubuntu data exposure apache2 regression

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
  apache2                         2.4.29-1ubuntu4.25
  apache2-bin                     2.4.29-1ubuntu4.25

Ubuntu 16.04 ESM:
  apache2                         2.4.18-2ubuntu3.17+esm7
  apache2-bin                     2.4.18-2ubuntu3.17+esm7

Ubuntu 14.04 ESM:
  apache2                         2.4.7-1ubuntu4.22+esm8
  apache2-bin                     2.4.7-1ubuntu4.22+esm8

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5487-3

https://ubuntu.com/security/notices/USN-5487-1

CVE-2022-26377, CVE-2022-28614, CVE-2022-28615, CVE-2022-29404,

CVE-2022-30522, CVE-2022-30556, CVE-2022-31813, https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1979577,

https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1979641

Severity
critical
Lowest
Low
Medium
High
Critical

June 23, 2022

Topics%20covered

Topics Covered

security advisory denial of service remote code execution ubuntu data exposure apache2 regression

Package Information

https://launchpad.net/ubuntu/+source/apache2/2.4.29-1ubuntu4.25

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.