PT-2022-3345 · Apache+10 · Apache Http Server+10
Ronald Crane
·
Published
2022-06-08
·
Updated
2025-03-22
·
CVE-2022-28614
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache HTTP Server versions 2.4.53 and earlier
Description
The issue is related to the ap rwrite() function in Apache HTTP Server, which may read unintended memory if an attacker can cause the server to reflect very large input using ap rwrite() or ap rputs(), such as with mod luas
r:puts() function. This can lead to an error reading beyond allocated boundaries and accessing memory outside the intended limits. The vulnerability is associated with integer overflow and boundary conditions in the ap rwrite() function. Exploitation of the vulnerability may allow a remote attacker to cause a denial of service.Recommendations
For Apache HTTP Server versions 2.4.53 and earlier, modules compiled and distributed separately from Apache HTTP Server that use the
ap rputs function and may pass it a very large (INT MAX or larger) string must be compiled against current headers to resolve the issue. As a temporary workaround, consider restricting the use of the ap rwrite() function and ap rputs() function, such as mod luas r:puts(), until the issue is resolved.Exploit
Fix
Information Disclosure
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Apache Http Server
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu