RHSA-2022:7647: Moderate: httpd:2.4 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.Security Fix(es): httpd: modsed: Read/write beyond bounds (CVE-2022-23943) httpd: modlua: Use of uninitialized value of in r:parsebody (CVE-2022-22719) httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721) httpd: modproxyajp: Possible request smuggling (CVE-2022-26377) httpd: modlua: DoS in r:parsebody (CVE-2022-29404) httpd: modsed: DoS vulnerability (CVE-2022-30522) httpd: modproxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813) httpd: Out-of-bounds read via aprwrite() (CVE-2022-28614) httpd: Out-of-bounds read in apstrcmpmatch() (CVE-2022-28615) httpd: modlua: Information disclosure with websockets (CVE-2022-30556) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e - Upgrade
Upgrade
redhat/httpd-filesystemto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e - Upgrade
Upgrade
redhat/httpd-manualto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e - Upgrade
Upgrade
redhat/httpd-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e - Upgrade
Upgrade
redhat/httpd-debugsourceto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e - Upgrade
Upgrade
redhat/httpd-develto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e - Upgrade
Upgrade
redhat/httpd-toolsto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e - Upgrade
Upgrade
redhat/httpd-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e.aa - Upgrade
Upgrade
redhat/httpd-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e.aa - Upgrade
Upgrade
redhat/httpd-debugsourceto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e.aa - Upgrade
Upgrade
redhat/httpd-develto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e.aa - Upgrade
Upgrade
redhat/httpd-toolsto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e.aa - Upgrade
Upgrade
redhat/httpd-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-51.module+el8.7.0+16050+02173b8e.aa - Compensating control
Apply the specified Red Hat httpd security update as described in the advisory details (update includes the changes for the listed CVEs, and the httpd daemon will be restarted automatically after installing the updated packages).
Event History
Frequently Asked Questions
What are the vulnerabilities addressed in RHSA-2022:7647?
RHSA-2022:7647 addresses vulnerabilities in mod_sed (CVE-2022-23943) and mod_lua (CVE-2022-22719) for the Apache HTTP Server.
What is the recommended version to fix RHSA-2022:7647?
To fix RHSA-2022:7647, upgrade to httpd version 2.4.37-51.module+el8.7.0+16050+02173b8e.
How can I verify if my system is affected by RHSA-2022:7647?
You can check your current httpd package version against the affected versions listed in RHSA-2022:7647.
What platforms are affected by RHSA-2022:7647?
RHSA-2022:7647 affects multiple platforms including x86_64, ppc64le, and other architectures with the impacted httpd packages.
What type of issues do the vulnerabilities in RHSA-2022:7647 pose?
The vulnerabilities in RHSA-2022:7647 can lead to read/write operations beyond bounds and use of uninitialized values, causing potential security risks.