DeutschShown in its original language — a full translation is planned for a future version.
Apache HTTP Server: Mehrere Schwachstellen
view advisory published 2022-06-07
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um falsche Informationen darzustellen, vertrauliche Informationen offenzulegen, einen Denial of Service Zustand herzustellen und Sicherheitsmaßnahmen zu umgehen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-31813US | critical9.8OT high | Exploit | ||
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to b… | ||||
| CVE-2022-30556US | high7.5 | — | ||
Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. | ||||
| CVE-2022-30522US | high7.5 | — | ||
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory al… | ||||
| CVE-2022-29404US | high7.5 | — | ||
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size… | ||||
| CVE-2022-28615US | critical9.1 | — | ||
Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While n… | ||||
| CVE-2022-28614US | medium5.3 | — | ||
The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap… | ||||
| CVE-2022-28330US | medium5.3 | — | ||
Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. | ||||
| CVE-2022-26377US | high7.5 | Exploit | ||
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP serve… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2022-9675 vom 2022-08-04external
- Oracle Linux Security Advisory ELSA-2022-9676 vom 2022-08-04external
- Oracle Linux Security Advisory ELSA-2022-9680 vom 2022-08-05external
- Oracle Linux Security Advisory ELSA-2022-9714 vom 2022-08-17external
- Red Hat Security Advisory RHSA-2022:6753 vom 2022-09-29external
- Red Hat Security Advisory RHSA-2022:7647 vom 2022-11-08external
- Red Hat Security Advisory RHSA-2022:8067 vom 2022-11-15external
- Red Hat Security Advisory RHSA-2022:8840 vom 2022-12-08external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan