Red Hat Security AdvisoryRHSA-2022:1915
httpd:2.4 security and bug fix update
Released 2022-05-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-47.module+el8.6.0+14529+083145da.1.aarch64::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+14529+083145da.1.ppc64le::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+14529+083145da.1.s390x::httpd:2.4 +38
Fixes 4 records
Priority HIGH 76
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.82295 · Published 2021-12-20 · Partial fix CWE-476
Priority HIGH 68
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.63721 · Published 2021-09-16 · Partial fix CWE-125
Priority MEDIUM 64
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.53191 · Published 2021-06-10 · Partial fix CWE-787
Priority MEDIUM 63
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.46179 · Published 2021-08-16 · Partial fix
