Amazon Linux AMI update for httpd



| Updated: 2024-10-25
Risk Critical
Patch available YES
Number of vulnerabilities 14
CVE-ID CVE-2021-44224
CVE-2021-44790
CVE-2022-22719
CVE-2022-22720
CVE-2022-22721
CVE-2022-23943
CVE-2022-26377
CVE-2022-28330
CVE-2022-28614
CVE-2022-28615
CVE-2022-29404
CVE-2022-30522
CVE-2022-30556
CVE-2022-31813
CWE-ID CWE-918
CWE-119
CWE-20
CWE-444
CWE-190
CWE-787
CWE-125
CWE-400
CWE-287
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #7 is available.
Vulnerable software
 Amazon Linux AMI
Operating systems & Components / Operating system

httpd
Operating systems & Components / Operating system package or component

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 14 vulnerabilities.

1) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU59057

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-44224

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in forward proxy configurations. A remote attacker can send a specially crafted HTTP request and trick the web server to initiate requests to arbitrary systems or cause NULL pointer dereference error and crash the web server.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

SSRF if possible for configuration that mix forward and reverse proxy.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU59056

Risk: Critical

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Red]

CVE-ID: CVE-2021-44790

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing multipart content in mod_lua. A remote attacker can send a specially crafted HTTP request to the affected web server, trigger buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Input validation error

EUVDB-ID: #VU61287

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-22719

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized value in r:parsebody. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU61286

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-22720

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Integer overflow

EUVDB-ID: #VU61285

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-22721

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the ap_escape_html2() function when parsing LimitXMLRequestBody. A remote attacker can send a specially crafted request to the web server, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds write

EUVDB-ID: #VU61284

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-23943

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in mod_sed. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU64078

Risk: Medium

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2022-26377

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests in mod_proxy_ajp. A remote attacker can send a specially crafted HTTP request to the server and smuggle requests to the AJP server it forwards requests to.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Out-of-bounds read

EUVDB-ID: #VU64080

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-28330

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition with the mod_isapi module. A remote attacker can send a specially crafted HTTP request to the server, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.

Note, only Windows installations are affected by this vulnerability.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Out-of-bounds read

EUVDB-ID: #VU64081

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-28614

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ap_rwrite() function. A remote attacker can with the ability to force the server to reflect a very large input using ap_rwrite() or ap_rputs() (such as with mod_luas r:puts() function) can trigger an out-of-bounds read error and read read unintended memory on the system.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds read

EUVDB-ID: #VU64083

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-28615

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ap_strcmp_match() function when processing an extremely large input buffer. A remote attacker can send a specially crafted HTTP request to the web server, trigger an out-of-bounds read error and read contents of memory on the system.

Note, the code distributed with the Apache HTTP Server cannot be coerced into such a call. The vulnerability can affect third-party modules or lua scripts that use ap_strcmp_match().

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU64085

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-29404

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing HTTP requests to a lua script that calls r:parsebody(0). A remote attacker can send a very large HTTP request to the affected web server and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Resource exhaustion

EUVDB-ID: #VU64086

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-30522

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to mod_sed does not properly control consumption of internal resources, if the web server is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds read

EUVDB-ID: #VU64088

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-30556

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing HTTP requests in mod_lua with websockets. A remote attacker can force the module to return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer and gain access to sensitive information.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper Authentication

EUVDB-ID: #VU64089

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-31813

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in mod_proxy implementation, where the web server may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. A remote attacker can bypass IP based authentication on the origin server/application and gain access to otherwise restricted functionality.

Mitigation

Update the affected packages:

aarch64:
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-2.4.54-3.amzn2023.0.4.aarch64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-2.4.54-3.amzn2023.0.4.aarch64
    httpd-devel-2.4.54-3.amzn2023.0.4.aarch64
    mod_ldap-2.4.54-3.amzn2023.0.4.aarch64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    mod_lua-2.4.54-3.amzn2023.0.4.aarch64
    httpd-tools-2.4.54-3.amzn2023.0.4.aarch64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-2.4.54-3.amzn2023.0.4.aarch64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.aarch64

noarch:
    httpd-manual-2.4.54-3.amzn2023.0.4.noarch
    httpd-filesystem-2.4.54-3.amzn2023.0.4.noarch

src:
    httpd-2.4.54-3.amzn2023.0.4.src

x86_64:
    mod_lua-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debugsource-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_session-2.4.54-3.amzn2023.0.4.x86_64
    httpd-2.4.54-3.amzn2023.0.4.x86_64
    httpd-devel-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_lua-2.4.54-3.amzn2023.0.4.x86_64
    mod_ssl-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_ldap-2.4.54-3.amzn2023.0.4.x86_64
    httpd-tools-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-debuginfo-2.4.54-3.amzn2023.0.4.x86_64
    mod_proxy_html-2.4.54-3.amzn2023.0.4.x86_64
    httpd-core-2.4.54-3.amzn2023.0.4.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

httpd: before 2.4.54-3

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-072.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###