Red Hat Security AdvisoryRHSA-2022:1045
httpd security update
Released 2022-03-24 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-97.el7_9.5, httpd-devel-2.4.6-97.el7_9.5, httpd-manual-2.4.6-97.el7_9.5 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-97.el7_9.5, httpd-devel-2.4.6-97.el7_9.5, httpd-manual-2.4.6-97.el7_9.5 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-97.el7_9.5, httpd-devel-2.4.6-97.el7_9.5, httpd-manual-2.4.6-97.el7_9.5 +3
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-97.el7_9.5, mod_proxy_html-1:2.4.6-97.el7_9.5
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-97.el7_9.5, httpd-devel-2.4.6-97.el7_9.5, httpd-manual-2.4.6-97.el7_9.5 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-97.el7_9.5, mod_proxy_html-1:2.4.6-97.el7_9.5
Fixes 1 record
Priority HIGH 65
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.28189 · Published 2022-03-14 · Partial fix CWE-444
