PT-2022-4993 · Lighttpd+4 · Mod Fastcgi+5

Published 2022-09-02 · Updated 2024-06-15 · CVE-2022-41556

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions lighttpd versions 1.4.56 through 1.4.66

Description A resource leak in gw backend.c could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. The use of mod fastcgi is affected.

Recommendations For versions 1.4.56 through 1.4.66, update to version 1.4.67 to resolve the issue. As a temporary workaround, consider restricting the use of mod fastcgi until a patch is available.

Exploit

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2022-2649

ALT-PU-2022-2735

ALT-PU-2022-2863

BDU:2022-06197

CVE-2022-41556

DSA-5243-1

MGASA-2022-0369

OESA-2022-1989

OPENSUSE-SU-2022:10140-1

OPENSUSE-SU-2024:12382-1

USN-5903-1

Affected Products

Alt Linux

Lighttpd

Linuxmint

Red Os

Ubuntu

Mod Fastcgi

References · 34

• 🔥 https://github.com/lighttpd/lighttpd1.4/pull/115 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-37797 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0369 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1989 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41556 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10140-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5903-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41556 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22707 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41556 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-41556 · Vendor Advisory
• https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/b18de6f9264f914f7bf493abd3b6059343548e50 · Patch
• https://cve.org/CVERecord?id=CVE-2022-41556 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41556 · Security Note
• https://security.gentoo.org/glsa/202210-12 · Vendor Advisory