RHSA-2022:8067 - Security Advisory

Topic

An update for httpd is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

The following packages have been upgraded to a later upstream version: httpd (2.4.53). (BZ#2079939)

Security Fix(es):

• httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)
• httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719)
• httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)
• httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)
• httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)
• httpd: mod_sed: DoS vulnerability (CVE-2022-30522)
• httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)
• httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)
• httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)
• httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

• BZ - 2064319 - CVE-2022-23943 httpd: mod_sed: Read/write beyond bounds
• BZ - 2064320 - CVE-2022-22721 httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
• BZ - 2064322 - CVE-2022-22719 httpd: mod_lua: Use of uninitialized value of in r:parsebody
• BZ - 2073459 - Cannot override LD_LIBARY_PATH in Apache HTTPD using SetEnv or PassEnv. Needs documentation.
• BZ - 2075406 - httpd.conf uses icon bomb.gif for all files/dirs ending with core
• BZ - 2079939 - httpd rebase to 2.4.53
• BZ - 2094997 - CVE-2022-26377 httpd: mod_proxy_ajp: Possible request smuggling
• BZ - 2095002 - CVE-2022-28614 httpd: Out-of-bounds read via ap_rwrite()
• BZ - 2095006 - CVE-2022-28615 httpd: Out-of-bounds read in ap_strcmp_match()
• BZ - 2095012 - CVE-2022-29404 httpd: mod_lua: DoS in r:parsebody
• BZ - 2095015 - CVE-2022-30522 httpd: mod_sed: DoS vulnerability
• BZ - 2095018 - CVE-2022-30556 httpd: mod_lua: Information disclosure with websockets
• BZ - 2095020 - CVE-2022-31813 httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism
• BZ - 2095838 - mod_mime_magic: invalid type 0 in mconvert()

CVEs

• CVE-2022-22719
• CVE-2022-22721
• CVE-2022-23943
• CVE-2022-26377
• CVE-2022-28614
• CVE-2022-28615
• CVE-2022-29404
• CVE-2022-30522
• CVE-2022-30556
• CVE-2022-31813

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index