{
  "cveId": "CVE-2022-28330",
  "url": "https://patchblox.com/security/cve/CVE-2022-28330",
  "summary": "CVE-2022-28330 is fixed in 20 products on 1 platform, first by ALAS2023-2023-072, released February 17, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "httpd: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2022-31813:\n\tA flaw w...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2022-31813:\n\tA flaw was found in the mod_proxy module of httpd. The server may remove the X-Forwarded-* headers from a request based on the client-side Connection header hop-by-hop mechanism.\n\nCVE-2022-30556:\n\tA flaw was found in the mod_lua module of httpd. The data returned by the wsread function may point past the end of the storage allocated for the buffer, resulting in information disclosure.\n\nCVE-2022-30522:\n\tA flaw was found in the mod_sed module of httpd. A very large input to the mod_sed module can result in a denial of service due to excessively large memory allocations.\n\nCVE-2022-29404:\n\tA flaw was found in the mod_lua module of httpd. A malicious request to a Lua script that calls parsebody(0) can lead to a denial of service due to no default limit on the possible input size.\n\nCVE-2022-28615:\n\tAn out-of-bounds read vulnerability was found in httpd. A very large input to the ap_strcmp_match function can lead to an integer overflow and result in an out-of-bounds read.\n\nCVE-2022-28614:\n\tAn out-of-bounds read vulnerability was found in httpd. A very large input to the ap_rputs and ap_rwrite functions can lead to an integer overflow and result in an out-of-bounds read.\n\nCVE-2022-28330:\n\tAn out-of-bounds read vulnerability was found in the mod_isapi module of httpd. The issue occurs when httpd is configured to process requests with the mod_isapi module.\n\nCVE-2022-26377:\n\tAn HTTP request smuggling vulnerability was found in the mod_proxy_ajp module of httpd. This flaw allows an attacker to smuggle requests to the AJP server, where it forwards requests.\n\nCVE-2022-23943:\n\tAn out-of-bounds read/write vulnerability was found in the mod_sed module of httpd. This flaw allows an attacker to overwrite the memory of an httpd instance that is using mod_sed with data provided by the attacker.\n\nCVE-2022-22721:\n\tA flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write.\n\nCVE-2022-22720:\n\tA flaw was found in httpd. The inbound connection is not closed when it fails to discard the request body, which may expose the server to HTTP request smuggling.\n\nCVE-2022-22719:\n\tA flaw was found in the mod_lua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The highest treat of this vulnerability is availability.\n\nCVE-2021-44790:\n\tA buffer overflow flaw in httpd\u0027s lua module could allow an out-of-bounds write. An attacker who is able to submit a crafted request to an httpd instance that is using the lua module may be able to cause an impact to confidentiality, integrity, and/or availability.\n\nCVE-2021-44224:\n\tThere\u0027s a null pointer dereference and server-side request forgery flaw in httpd\u0027s mod_proxy module, when it is configured to be used as a forward proxy. A crafted packet could be sent on the adjacent network to the forward proxy that could cause a crash, or potentially SSRF via misdirected Unix Domain Socket requests. In the worst case, this could cause a denial of service or compromise to confidentiality of data.",
  "published": "2023-02-17T20:46:00Z",
  "severity": "important",
  "epss": 0.03926,
  "epssPercentile": 0.90434,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "httpd",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "httpd-core",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "httpd-core-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "httpd-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "httpd-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "httpd-devel",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "httpd-filesystem",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "httpd-manual",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "httpd-tools",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "httpd-tools-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_ldap",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_ldap-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_lua",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_lua-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_proxy_html",
      "release": "amzn 2023",
      "fixedVersion": "1:2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_proxy_html-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_session",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_session-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_ssl",
      "release": "amzn 2023",
      "fixedVersion": "1:2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_ssl-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:2.4.54-3.amzn2023.0.4",
      "fix": "ALAS2023-2023-072",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-072",
      "released": "2023-02-17T20:46:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}