CVE-2022-22721: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
First published: Mon Mar 14 2022(Updated: )
A flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write.
Credit: CVE-2021-44224 CVE-2021-44790 CVE-2022-22719 CVE-2022-22720 CVE-2022-22721 CVE-2021-44224 CVE-2021-44790 CVE-2022-22719 CVE-2022-22720 CVE-2022-22721 CVE-2021-44224 CVE-2021-44790 CVE-2022-22719 CVE-2022-22720 CVE-2022-22721 security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Catalina | ||
| Apple macOS Big Sur | <11.6.6 | 11.6.6 |
| <12.4 | 12.4 | |
| Apache HTTP server | <=2.4.52 | |
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 | |
| Debian Debian Linux | =9.0 | |
| Oracle Enterprise Manager Ops Center | =12.4.0.0 | |
| Oracle HTTP Server | =12.2.1.3.0 | |
| Oracle HTTP Server | =12.2.1.4.0 | |
| Oracle ZFS Storage Appliance Kit | =8.8 | |
| Apple Mac OS X | >=10.15<10.15.7 | |
| Apple Mac OS X | =10.15.7-security_update_2020-001 | |
| Apple Mac OS X | =10.15.7-security_update_2021-001 | |
| Apple Mac OS X | =10.15.7-security_update_2021-002 | |
| Apple Mac OS X | =10.15.7-security_update_2021-003 | |
| Apple Mac OS X | =10.15.7-security_update_2021-004 | |
| Apple Mac OS X | =10.15.7-security_update_2021-005 | |
| Apple Mac OS X | =10.15.7-security_update_2021-006 | |
| Apple Mac OS X | =10.15.7-security_update_2021-007 | |
| Apple Mac OS X | =10.15.7-security_update_2021-008 | |
| Apple Mac OS X | =10.15.7-security_update_2022-001 | |
| Apple Mac OS X | =10.15.7-security_update_2022-002 | |
| Apple Mac OS X | =10.15.7-security_update_2022-003 | |
| Apple macOS | >=11.0<11.6.6 | |
| Apple macOS | >=12.0<12.4 | |
| redhat/httpd | <2.4.53 | 2.4.53 |
| redhat/jbcs-httpd24-httpd | <0:2.4.51-37.el8 | 0:2.4.51-37.el8 |
| redhat/jbcs-httpd24-httpd | <0:2.4.51-37.el7 | 0:2.4.51-37.el7 |
| redhat/httpd | <0:2.4.53-7.el9 | 0:2.4.53-7.el9 |
| redhat/httpd24-httpd | <0:2.4.34-23.el7.5 | 0:2.4.34-23.el7.5 |
Remedy
Set the LimitXMLRequestBody option to a value smaller than 350MB. Setting it to 0 is not recommended as it will use a hard limit (depending on 32bit or 64bit systems) which may result in an overall system out-of-memory. The default configuration is not vulnerable to this flaw, see the statement above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-22721 https://nvd.nist.gov/vuln/detail/CVE-2022-22721 https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-22721
- https://bugzilla.redhat.com/show_bug.cgi?id=2064320
- https://access.redhat.com/errata/RHSA-2022:8840
- https://access.redhat.com/errata/RHSA-2022:7647
- https://access.redhat.com/errata/RHSA-2022:8067
- https://access.redhat.com/errata/RHSA-2022:8841
- https://access.redhat.com/errata/RHSA-2022:6753
- https://access.redhat.com/security/cve/cve-2022-22721
- https://support.apple.com/en-us/HT213255 (Advisory)
- http://seclists.org/fulldisclosure/2022/May/33
- http://seclists.org/fulldisclosure/2022/May/35
- http://seclists.org/fulldisclosure/2022/May/38
- http://www.openwall.com/lists/oss-security/2022/03/14/2
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/
- https://security.gentoo.org/glsa/202208-20
- https://security.netapp.com/advisory/ntap-20220321-0001/
- https://support.apple.com/kb/HT213255
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213257
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://support.apple.com/en-us/HT213256 (Advisory)
- https://support.apple.com/en-us/HT213257 (Advisory)
- https://www.openwall.com/lists/oss-security/2022/03/14/2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2064571
- https://svn.apache.org/viewvc?view=revision&revision=1898693
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2021-44224
- CVE-2021-44790
- CVE-2022-22719
- CVE-2022-22720
- CVE-2022-22721
- CVE-2022-22665
- CVE-2022-22630
- CVE-2022-26751
- CVE-2022-26697
- CVE-2022-26698
- CVE-2022-22663
- CVE-2022-26721
- CVE-2022-26722
- CVE-2022-26763
- CVE-2022-22674
- CVE-2022-26720
- CVE-2022-26770
- CVE-2022-26756
- CVE-2022-26769
- CVE-2022-26748
- CVE-2022-26714
- CVE-2022-26757
- CVE-2022-32790
- CVE-2022-26775
- CVE-2022-0778
- CVE-2022-23308
- CVE-2022-32794
- CVE-2022-26727
- CVE-2022-26746
- CVE-2022-26766
- CVE-2022-26715
- CVE-2022-26728
- CVE-2022-26726
- CVE-2022-26755
- CVE-2022-22589
- CVE-2022-26761
- CVE-2022-0530
- CVE-2018-25032
- CVE-2021-45444
- CVE-2022-22675
- CVE-2022-26768
- CVE-2021-30946
- CVE-2022-26767
- CVE-2022-26706
- CVE-2022-32882
- CVE-2022-26776
- CVE-2022-26712
- CVE-2022-26731
- CVE-2022-26718
- CVE-2022-26723
- CVE-2021-4136
- CVE-2021-4166
- CVE-2021-4173
- CVE-2021-4187
- CVE-2021-4192
- CVE-2021-4193
- CVE-2021-46059
- CVE-2022-0128
- CVE-2022-26745
- CVE-2022-26772
- CVE-2022-26741
- CVE-2022-26742
- CVE-2022-26749
- CVE-2022-26750
- CVE-2022-26752
- CVE-2022-26753
- CVE-2022-26754
- CVE-2022-26707
- CVE-2022-26736
- CVE-2022-26737
- CVE-2022-26738
- CVE-2022-26739
- CVE-2022-26740
- CVE-2022-32783
- CVE-2022-26694
- CVE-2022-32781
- CVE-2022-26711
- CVE-2022-26725
- CVE-2022-26701
- CVE-2022-26758
- CVE-2022-26743
- CVE-2022-26764
- CVE-2022-26765
- CVE-2022-26708
- CVE-2022-48575
- CVE-2022-22617
- CVE-2022-32782
- CVE-2022-26693
- CVE-2022-26704
- CVE-2022-42857
- CVE-2022-26696
- CVE-2022-26700
- CVE-2022-26709
- CVE-2022-26710
- CVE-2022-26717
- CVE-2022-26716
- CVE-2022-26719
- CVE-2022-22677
- CVE-2022-26762
Frequently Asked Questions
What is CVE-2022-22721?
CVE-2022-22721 is a vulnerability in Apache HTTP Server where an integer overflow occurs when LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32-bit systems, which can lead to out-of-bounds writes.
How does CVE-2022-22721 affect Apache HTTP Server?
CVE-2022-22721 affects Apache HTTP Server version 2.4.52 and earlier.
What is the severity of CVE-2022-22721?
CVE-2022-22721 has a severity rating of high (7).
How can I fix CVE-2022-22721?
To fix CVE-2022-22721, update Apache HTTP Server to version 2.4.53 or later.
Where can I find more information about CVE-2022-22721?
You can find more information about CVE-2022-22721 at the following references: [Link 1](https://support.apple.com/en-us/HT213257), [Link 2](https://support.apple.com/en-us/HT213255), [Link 3](https://support.apple.com/en-us/HT213256).
- collector/redhat-cve
- collector/apple-support
- alias/CVE-2021-44790
- alias/CVE-2022-22719
- alias/CVE-2022-22720
- alias/CVE-2022-22721
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/author
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/last-modified-date
- source/Apple
- agent/event
- agent/tags
- agent/trending
- package-manager/redhat
- vendor/apple
- canonical/apple catalina
- vendor/apache
- canonical/apache http server
- version/apache http server/2.4.52
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/oracle
- canonical/oracle enterprise manager ops center
- version/oracle enterprise manager ops center/12.4.0.0
- canonical/oracle http server
- version/oracle http server/12.2.1.3.0
- version/oracle http server/12.2.1.4.0
- canonical/oracle zfs storage appliance kit
- version/oracle zfs storage appliance kit/8.8
- canonical/apple mac os x
- version/apple mac os x/10.15
- version/apple mac os x/10.15.7-security_update_2020-001
- version/apple mac os x/10.15.7-security_update_2021-001
- version/apple mac os x/10.15.7-security_update_2021-002
- version/apple mac os x/10.15.7-security_update_2021-003
- version/apple mac os x/10.15.7-security_update_2021-004
- version/apple mac os x/10.15.7-security_update_2021-005
- version/apple mac os x/10.15.7-security_update_2021-006
- version/apple mac os x/10.15.7-security_update_2021-007
- version/apple mac os x/10.15.7-security_update_2021-008
- version/apple mac os x/10.15.7-security_update_2022-001
- version/apple mac os x/10.15.7-security_update_2022-002
- version/apple mac os x/10.15.7-security_update_2022-003
- canonical/apple macos
- version/apple macos/11.0
- version/apple macos/12.0
- canonical/apple macos big sur
- canonical/apple macos monterey