CVE-2022-28615

Published: 9 June 2022

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.

Priority

Cvss 3 Severity Score

9.1

Score breakdown

Status

Package	Release	Status
apache2 Launchpad, Ubuntu, Debian	upstream	Released (2.4.54-1)
	bionic	Released (2.4.29-1ubuntu4.24)
	focal	Released (2.4.41-4ubuntu3.12)
	impish	Released (2.4.48-3.1ubuntu3.5)
	jammy	Released (2.4.52-1ubuntu4.1)
	kinetic	Released (2.4.54-2ubuntu1)
	Patches: upstream: https://github.com/apache/httpd/commit/6503d09ab51047554c384a6d03646ce1a8848120

Severity score breakdown

Parameter	Value
Base score	9.1
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012513

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›