ALAS2023-2023-072: Security update for 20 packages

ALAS2023-2023-072, released February 17, 2023, fixes 14 CVEs across 20 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.9684

99th percentile

Priority of the 14 CVEs

Patch now 0
                                Urgent 0
                                High 14
                                Routine 0

Fixed package versions

Product	Release	Fixed in
httpd	amzn 2023	2.4.54-3.amzn2023.0.4
httpd-core	amzn 2023	2.4.54-3.amzn2023.0.4
httpd-core-debuginfo	amzn 2023	2.4.54-3.amzn2023.0.4
httpd-debuginfo	amzn 2023	2.4.54-3.amzn2023.0.4
httpd-debugsource	amzn 2023	2.4.54-3.amzn2023.0.4
httpd-devel	amzn 2023	2.4.54-3.amzn2023.0.4
httpd-filesystem	amzn 2023	2.4.54-3.amzn2023.0.4
httpd-manual	amzn 2023	2.4.54-3.amzn2023.0.4
httpd-tools	amzn 2023	2.4.54-3.amzn2023.0.4
httpd-tools-debuginfo	amzn 2023	2.4.54-3.amzn2023.0.4
mod_ldap	amzn 2023	2.4.54-3.amzn2023.0.4
mod_ldap-debuginfo	amzn 2023	2.4.54-3.amzn2023.0.4
mod_lua	amzn 2023	2.4.54-3.amzn2023.0.4
mod_lua-debuginfo	amzn 2023	2.4.54-3.amzn2023.0.4
mod_proxy_html	amzn 2023	1:2.4.54-3.amzn2023.0.4
mod_proxy_html-debuginfo	amzn 2023	1:2.4.54-3.amzn2023.0.4
mod_session	amzn 2023	2.4.54-3.amzn2023.0.4
mod_session-debuginfo	amzn 2023	2.4.54-3.amzn2023.0.4
mod_ssl	amzn 2023	1:2.4.54-3.amzn2023.0.4
mod_ssl-debuginfo	amzn 2023	1:2.4.54-3.amzn2023.0.4

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2021-44790	httpd-devel: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es...	9.8	0.9684	None reported
High	CVE-2022-30522	libapache2-mod-proxy-uwsgi: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed...	8.1	0.8989	None reported
High	CVE-2021-44224	httpd: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es...	8.2	0.8230	None reported
High	CVE-2022-22719	apache2: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash	8.1	0.6980	None reported
High	CVE-2022-23943	apache2-data: Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with p...	9.8	0.5040	None reported
High	CVE-2022-22721	apache2-suexec-custom: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer...	9.1	0.4186	None reported
High	CVE-2022-22720	apache2-data: Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the re...	9.8	0.2819	None reported
High	CVE-2022-26377	httpd-manual: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es...	8.1	0.2108	None reported
High	CVE-2022-29404	apache2: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a d...	8.1	0.0655	None reported
High	CVE-2022-28615	apache2-utils: Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_matc...	9.1	0.0646	None reported
High	CVE-2022-30556	httpd: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es...	8.1	0.0541	None reported
High	CVE-2022-28614	apache2: The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause...	8.1	0.0511	None reported
High	CVE-2022-28330	httpd: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-31813: A flaw w...	n/a	0.0393	None reported
High	CVE-2022-31813	libapache2-mod-proxy-uwsgi: Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client sid...	9.8	0.0354	None reported

Also fixes CVE-2021-44790

apache2 2.4.29-1ubuntu4.21
apache2 on Ubuntu 18.04.6 LTS (bionic)
apache2 2.4.41-4ubuntu3.9
apache2 on Ubuntu 20.04 LTS (focal)
apache2 2.4.52-1ubuntu1
apache2 on Ubuntu 22.04.1 LTS (jammy)
apache2-bin 2.4.29-1ubuntu4.21
apache2-bin on Ubuntu 18.04.6 LTS (bionic)
apache2-bin 2.4.41-4ubuntu3.9
apache2-bin on Ubuntu 20.04 LTS (focal)
apache2-bin 2.4.52-1ubuntu1
apache2-bin on Ubuntu 22.04.1 LTS (jammy)
apache2-data 2.4.29-1ubuntu4.21
apache2-data on Ubuntu 18.04.6 LTS (bionic)
apache2-data 2.4.41-4ubuntu3.9
apache2-data on Ubuntu 20.04 LTS (focal)

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2023-072">ALAS2023-2023-072 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.