CVE-2022-23943: mod_sed: Read/write beyond bounds

Q: What is CVE-2022-23943?

CVE-2022-23943 is an out-of-bounds read/write vulnerability found in the mod_sed module of Apache HTTP Server.

Q: How does CVE-2022-23943 impact Apache HTTP Server?

CVE-2022-23943 allows an attacker to overwrite heap memory with possibly attacker-provided data.

Q: What versions of Apache HTTP Server are affected by CVE-2022-23943?

Apache HTTP Server versions 2.4.52 and prior versions are affected by CVE-2022-23943.

Q: What is the severity of CVE-2022-23943?

CVE-2022-23943 has a severity rating of critical (9.8).

Q: How can I fix CVE-2022-23943?

To fix CVE-2022-23943, update Apache HTTP Server to version 2.4.53 or later.

Published Mar 14, 2022

Updated

An out-of-bounds read/write vulnerability was found in the modsed module of httpd. This flaw allows an attacker to overwrite the memory of an httpd instance that is using modsed with data provided by the attacker.

Other sources

Out-of-bounds Write vulnerability in modsed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

Affected Software

14 affected componentsFixes available

redhat/jbcs-httpd24-httpd<0:2.4.51-37.el8

0:2.4.51-37.el8

redhat/jbcs-httpd24-httpd<0:2.4.51-37.el7

0:2.4.51-37.el7

redhat/httpd<0:2.4.53-7.el9

0:2.4.53-7.el9

redhat/httpd24-httpd<0:2.4.34-23.el7.5

0:2.4.34-23.el7.5

redhat/httpd<2.4.53

2.4.53

Apache HTTP Server>=2.4.0<=2.4.52

Fedoraproject Fedora=34

Fedoraproject Fedora=35

Fedoraproject Fedora=36

Debian Debian Linux=9.0

Oracle HTTP Server=12.2.1.3.0

Oracle HTTP Server=12.2.1.4.0

Oracle ZFS Storage Appliance Kit=8.8

Apache HTTP Server>=2.4.0<2.4.53

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.51-37.el8
Upgrade
Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.51-37.el7
Upgrade
Upgrade redhat/httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.53-7.el9
Upgrade
Upgrade redhat/httpd24-httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.34-23.el7.5
Upgrade
Upgrade redhat/httpd to a version that resolves this vulnerability.
Fixed in 2.4.53
Configuration
Disable the mod_sed module and restart httpd to mitigate the out-of-bounds read/write vulnerability.
Apache httpd (mod_sed) mod_sed = disabled
Compensating control
If disabling mod_sed is not immediately possible, ensure the httpd instance is not using mod_sed, since the flaw affects Apache HTTP Server 2.4.52 and prior versions when mod_sed is enabled.

Event History

Mar 14, 2022

CVE Published

12:00 AM

CVE Published

via MITRE·10:15 AM

Data Sourced

via MITRE·10:15 AM

DescriptionWeakness

Mar 15, 2022

Data Sourced

via Red Hat·02:33 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2022-23943?

CVE-2022-23943 is an out-of-bounds read/write vulnerability found in the mod_sed module of Apache HTTP Server.

How does CVE-2022-23943 impact Apache HTTP Server?

CVE-2022-23943 allows an attacker to overwrite heap memory with possibly attacker-provided data.

What versions of Apache HTTP Server are affected by CVE-2022-23943?