CVE-2022-22720
Published: 14 March 2022
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
Priority
Medium
CVSS 3 base score: 9.8
Status
| Package | Release | Status |
|---|---|---|
|
apache2 Launchpad, Ubuntu, Debian |
bionic |
Released
(2.4.29-1ubuntu4.22)
|
| focal |
Released
(2.4.41-4ubuntu3.10)
|
|
| impish |
Released
(2.4.48-3.1ubuntu3.3)
|
|
| jammy |
Released
(2.4.52-1ubuntu2)
|
|
| trusty |
Released
(2.4.7-1ubuntu4.22+esm4)
|
|
| upstream |
Released
(2.4.53)
|
|
| xenial |
Released
(2.4.18-2ubuntu3.17+esm5)
|
|
|
Patches: upstream: https://svn.apache.org/viewvc?view=revision&revision=1898692 (2.4) upstream: https://github.com/apache/httpd/commit/19aa2d83b379719420f3a178413325156d7a62f3 (2.4) |
||