Red Hat Security AdvisoryRHSA-2022:0258
httpd:2.4 security update
Released 2022-01-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-43.module+el8.5.0+13806+b30d9eec.1.aarch64::httpd:2.4, httpd-2.4.37-43.module+el8.5.0+13806+b30d9eec.1.ppc64le::httpd:2.4, httpd-2.4.37-43.module+el8.5.0+13806+b30d9eec.1.s390x::httpd:2.4 +38
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) httpd-2.4.37-21.module+el8.2.0+13808+dea277df.3.aarch64::httpd:2.4, httpd-2.4.37-21.module+el8.2.0+13808+dea277df.3.ppc64le::httpd:2.4, httpd-2.4.37-21.module+el8.2.0+13808+dea277df.3.s390x::httpd:2.4 +38
- Red Hat Enterprise Linux AppStream EUS (v.8.4) httpd-2.4.37-39.module+el8.4.0+13807+c8c001ae.3.aarch64::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+13807+c8c001ae.3.ppc64le::httpd:2.4, httpd-2.4.37-39.module+el8.4.0+13807+c8c001ae.3.s390x::httpd:2.4 +38
Fixes 1 record
Priority CRITICAL 86
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.9684 · Published 2021-12-20 · Partial fix CWE-787
