Linux · Security advisory · November 15, 2022
ELSA-2022-7647: Security update for 11 packages
ELSA-2022-7647, released November 15, 2022, fixes 9 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
9
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.8989
99th percentile
Priority of the 9 CVEs
Patch now 0
Urgent 0
High 9
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| httpd | ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+20778+02173b8e |
| httpd-devel | ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+20778+02173b8e |
| httpd-filesystem | ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+20778+02173b8e |
| httpd-manual | ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+20778+02173b8e |
| httpd-tools | ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+20778+02173b8e |
| mod_http2 | ol 8 | 0:1.15.7-5.module+el8.6.0+20548+01710940 |
| mod_ldap | ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+20778+02173b8e |
| mod_md | ol 8 | 1:2.0.8-8.module+el8.5.0+20475+4f6a8fd5 |
| mod_proxy_html | ol 8 | 1:2.4.37-51.0.1.module+el8.7.0+20778+02173b8e |
| mod_session | ol 8 | 0:2.4.37-51.0.1.module+el8.7.0+20778+02173b8e |
| mod_ssl | ol 8 | 1:2.4.37-51.0.1.module+el8.7.0+20778+02173b8e |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2022-30522 | libapache2-mod-proxy-uwsgi: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed... | 8.1 | 0.8989 | None reported | |
| High | CVE-2022-22719 | apache2: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash | 8.1 | 0.6980 | None reported | |
| High | CVE-2022-23943 | apache2-data: Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with p... | 9.8 | 0.5040 | None reported | |
| High | CVE-2022-22721 | apache2-suexec-custom: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer... | 9.1 | 0.4186 | None reported | |
| High | CVE-2022-26377 | httpd-manual: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... | 8.1 | 0.2108 | None reported | |
| High | CVE-2022-29404 | apache2: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a d... | 8.1 | 0.0655 | None reported | |
| High | CVE-2022-28615 | apache2-utils: Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_matc... | 9.1 | 0.0646 | None reported | |
| High | CVE-2022-30556 | httpd: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... | 8.1 | 0.0541 | None reported | |
| High | CVE-2022-28614 | apache2: The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause... | 8.1 | 0.0511 | None reported |
Showing 1 to 9 of 9
1