Linux · Security advisory · November 15, 2022
RLSA-2022:8067: httpd security update
RLSA-2022:8067, released November 15, 2022, fixes 10 CVEs in httpd (version 0:2.4.53-7.el9). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
10
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.8989
99th percentile
Priority of the 10 CVEs
Patch now 0
Urgent 0
High 10
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| httpd | rocky 9 | 0:2.4.53-7.el9 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2022-30522 | libapache2-mod-proxy-uwsgi: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed... | 8.1 | 0.8989 | None reported | |
| High | CVE-2022-22719 | apache2: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash | 8.1 | 0.6980 | None reported | |
| High | CVE-2022-23943 | apache2-data: Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with p... | 9.8 | 0.5040 | None reported | |
| High | CVE-2022-22721 | apache2-suexec-custom: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer... | 9.1 | 0.4186 | None reported | |
| High | CVE-2022-26377 | httpd-manual: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... | 8.1 | 0.2108 | None reported | |
| High | CVE-2022-29404 | apache2: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a d... | 8.1 | 0.0655 | None reported | |
| High | CVE-2022-28615 | apache2-utils: Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_matc... | 9.1 | 0.0646 | None reported | |
| High | CVE-2022-30556 | httpd: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es... | 8.1 | 0.0541 | None reported | |
| High | CVE-2022-28614 | apache2: The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause... | 8.1 | 0.0511 | None reported | |
| High | CVE-2022-31813 | libapache2-mod-proxy-uwsgi: Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client sid... | 9.8 | 0.0354 | None reported |
Showing 1 to 10 of 10
1