CVE-2022-28614: read beyond bounds via ap_rwrite()
An out-of-bounds read vulnerability was found in httpd. A very large input to the aprputs and aprwrite functions can lead to an integer overflow and result in an out-of-bounds read.
Other sources
The aprwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using aprwrite() or aprputs(), such as with modluas r:puts() function.
References: https://httpd.apache.org/security/vulnerabilities24.html https://www.openwall.com/lists/oss-security/2022/06/08/4
— Red Hat
The aprwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using aprwrite() or aprputs(), such as with modluas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'aprputs' function and may pass it a very large (INTMAX or larger) string must be compiled against current headers to resolve the issue.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-28614?
CVE-2022-28614 is an out-of-bounds read vulnerability in Apache HTTP Server 2.4.53 and earlier.
How does the vulnerability in CVE-2022-28614 work?
The vulnerability occurs when the ap_rwrite() function in Apache HTTP Server reads unintended memory if an attacker can cause the server to reflect very large input.
What is the severity of CVE-2022-28614?
CVE-2022-28614 has a severity rating of 5.3 (Medium).
Which versions of Apache HTTP Server are affected by CVE-2022-28614?
Apache HTTP Server versions 2.4.53 and earlier are affected by CVE-2022-28614.
How can I fix the vulnerability in CVE-2022-28614?
To fix the vulnerability, update Apache HTTP Server to version 2.4.54 or later.