Ubuntu 22.10 Advisory USN-5839-1 Critical: Apache HTTP Server Threats

ubuntu

February 1, 2023

Several security issues were fixed in Apache HTTP Server.

Summary

Several security issues were fixed in Apache HTTP Server.

Software Description:

- apache2: Apache HTTP server

Details:

It was discovered that the Apache HTTP Server mod_dav module incorrectly

handled certain If: request headers. A remote attacker could possibly use

this issue to cause the server to crash, resulting in a denial of service.

(CVE-2006-20001)

ZeddYu_Lu discovered that the Apache HTTP Server mod_proxy_ajp module

incorrectly interpreted certain HTTP Requests. A remote attacker could

possibly use this issue to perform an HTTP Request Smuggling attack.

(CVE-2022-36760)

Dimas Fariski Setyawan Putra discovered that the Apache HTTP Server

mod_proxy module incorrectly truncated certain response headers. This may

result in later headers not being interpreted by the client.

(CVE-2022-37436)

Topics Covered

security advisory denial of service critical apache ubuntu apache2 http request smuggling

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   apache2                         2.4.54-2ubuntu1.1

Ubuntu 22.04 LTS:
   apache2                         2.4.52-1ubuntu4.3

Ubuntu 20.04 LTS:
   apache2                         2.4.41-4ubuntu3.13

Ubuntu 18.04 LTS:
   apache2                         2.4.29-1ubuntu4.26

In general, a standard system update will make all the necessary changes.