CVE-2022-29404: Denial of service in mod_lua r:parsebody
A flaw was found in the modlua module of httpd. A malicious request to a Lua script that calls parsebody(0) can lead to a denial of service due to no default limit on the possible input size.
Other sources
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 0:2.4.53-7.el9 - Upgrade
Upgrade
redhat/httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.34-23.el7.5 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.54 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.69-1~deb13u1Fixed in 2.4.69-1 - Upgrade
Upgrade
alpine/apache2to a version that resolves this vulnerability.Fixed in 2.4.54-r0 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.54-1 - Configuration
Disable mod_lua and restart httpd to mitigate the denial-of-service flaw involving Lua scripts that call r:parsebody(0).
Apache HTTP Server mod_lua mod_lua = disabled
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-29404?
CVE-2022-29404 is a vulnerability in Apache HTTP Server 2.4.53 and earlier that can result in a denial of service due to a lack of input size limit.
How does CVE-2022-29404 affect Apache HTTP Server?
CVE-2022-29404 affects Apache HTTP Server versions 2.4.53 and earlier.
What is the severity of CVE-2022-29404?
CVE-2022-29404 has a severity rating of high with a severity value of 7.
How can I fix CVE-2022-29404?
To fix CVE-2022-29404, update Apache HTTP Server to version 2.4.54 or later.
Where can I find more information about CVE-2022-29404?
You can find more information about CVE-2022-29404 at the following references: [CVE-2022-29404](https://www.cve.org/CVERecord?id=CVE-2022-29404), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-29404), [Apache HTTP Server Security Vulnerabilities](https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-29404), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2095012), and [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2022:7647).