Linux · Security advisory · November 8, 2022
RHSA-2022:7647: Security update for 11 packages
RHSA-2022:7647, released November 8, 2022, fixes 10 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
10
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.8989
99th percentile
Priority of the 10 CVEs
Patch now 0
Urgent 0
High 10
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| httpd | RHEL 8 | 0:2.4.37-51.module+el8.7.0+16050+02173b8e |
| httpd-devel | RHEL 8 | 0:2.4.37-51.module+el8.7.0+16050+02173b8e |
| httpd-filesystem | RHEL 8 | 0:2.4.37-51.module+el8.7.0+16050+02173b8e |
| httpd-manual | RHEL 8 | 0:2.4.37-51.module+el8.7.0+16050+02173b8e |
| httpd-tools | RHEL 8 | 0:2.4.37-51.module+el8.7.0+16050+02173b8e |
| mod_http2 | RHEL 8 | 0:1.15.7-5.module+el8.6.0+13996+01710940 |
| mod_ldap | RHEL 8 | 0:2.4.37-51.module+el8.7.0+16050+02173b8e |
| mod_md | RHEL 8 | 1:2.0.8-8.module+el8.3.0+6814+67d1e611 |
| mod_proxy_html | RHEL 8 | 1:2.4.37-51.module+el8.7.0+16050+02173b8e |
| mod_session | RHEL 8 | 0:2.4.37-51.module+el8.7.0+16050+02173b8e |
| mod_ssl | RHEL 8 | 1:2.4.37-51.module+el8.7.0+16050+02173b8e |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2022-30522 | libapache2-mod-proxy-uwsgi: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed... | 8.1 | 0.8989 | None reported | |
| High | CVE-2022-22719 | apache2: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash | 8.1 | 0.6980 | None reported | |
| High | CVE-2022-23943 | apache2-data: Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with p... | 9.8 | 0.5040 | None reported | |
| High | CVE-2022-22721 | apache2-suexec-custom: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer... | 9.1 | 0.4186 | None reported | |
| High | CVE-2022-26377 | httpd-manual: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... | 8.1 | 0.2108 | None reported | |
| High | CVE-2022-29404 | apache2: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a d... | 8.1 | 0.0655 | None reported | |
| High | CVE-2022-28615 | apache2-utils: Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_matc... | 9.1 | 0.0646 | None reported | |
| High | CVE-2022-30556 | httpd: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... | 8.1 | 0.0541 | None reported | |
| High | CVE-2022-28614 | apache2: The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause... | 8.1 | 0.0511 | None reported | |
| High | CVE-2022-31813 | libapache2-mod-proxy-uwsgi: Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client sid... | 9.8 | 0.0354 | None reported |
Showing 1 to 10 of 10
1