Home / mailings [RHSA-2022:6753-01] Moderate: httpd24-httpd security and bug fix update
Posted on 29 September 2022
RedHat===================================================================== Red Hat Security Advisory
Synopsis: Moderate: httpd24-httpd security and bug fix update
Advisory ID: RHSA-2022:6753-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2022:6753
Issue date: 2022-09-29
CVE Names: CVE-2021-33193 CVE-2021-34798 CVE-2021-36160
CVE-2021-39275 CVE-2021-44224 CVE-2022-22719
CVE-2022-22721 CVE-2022-23943 CVE-2022-26377
CVE-2022-28614 CVE-2022-28615 CVE-2022-29404
CVE-2022-30522 CVE-2022-30556 CVE-2022-31813
=====================================================================
1. Summary:
An update for httpd24-httpd is now available for Red Hat Software
Collections.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
3. Description:
The httpd packages provide the Apache HTTP Server, a powerful, efficient,
and extensible web server.
Security Fix(es):
* httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)
* httpd: Request splitting via HTTP/2 method injection and mod_proxy
(CVE-2021-33193)
* httpd: NULL pointer dereference via malformed requests (CVE-2021-34798)
* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path
(CVE-2021-36160)
* httpd: Out-of-bounds write in ap_escape_quotes() via malicious input
(CVE-2021-39275)
* httpd: possible NULL dereference or SSRF in forward proxy configurations
(CVE-2021-44224)
* httpd: mod_lua: Use of uninitialized value of in r:parsebody
(CVE-2022-22719)
* httpd: core: Possible buffer overflow with very large or unlimited
LimitXMLRequestBody (CVE-2022-22721)
* httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)
* httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)
* httpd: mod_sed: DoS vulnerability (CVE-2022-30522)
* httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism
(CVE-2022-31813)
* httpd: out-of-bounds read via ap_rwrite() (CVE-2022-28614)
* httpd: out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)
* httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* proxy rewrite to unix socket fails with CVE-2021-40438 fix (BZ#2022319)
Additional changes:
* To fix CVE-2022-29404, the default value for the "LimitRequestBody"
directive in the Apache HTTP Server has been changed from 0 (unlimited) to
1 GiB.
On systems where the value of "LimitRequestBody" is not explicitly
specified in an httpd configuration file, updating the httpd package sets
"LimitRequestBody" to the default value of 1 GiB. As a consequence, if the
total size of the HTTP request body exceeds this 1 GiB default limit, httpd
returns the 413 Request Entity Too Large error code.
If the new default allowed size of an HTTP request message body is
insufficient for your use case, update your httpd configuration files
within the respective context (server, per-directory, per-file, or
per-location) and set your preferred limit in bytes. For example, to set a
new 2 GiB limit, use:
LimitRequestBody 2147483648
Systems already configured to use any explicit value for the
"LimitRequestBody" directive are unaffected by this change.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted
automatically.
5. Bugs fixed (https://bugzilla.redhat.com/):
1966728 - CVE-2021-33193 httpd: Request splitting via HTTP/2 method injection and mod_proxy
2005119 - CVE-2021-39275 httpd: Out-of-bounds write in ap_escape_quotes() via malicious input
2005124 - CVE-2021-36160 httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path
2005128 - CVE-2021-34798 httpd: NULL pointer dereference via malformed requests
2034672 - CVE-2021-44224 httpd: possible NULL dereference or SSRF in forward proxy configurations
2064319 - CVE-2022-23943 httpd: mod_sed: Read/write beyond bounds
2064320 - CVE-2022-22721 httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
2064322 - CVE-2022-22719 httpd: mod_lua: Use of uninitialized value of in r:parsebody
2094997 - CVE-2022-26377 httpd: mod_proxy_ajp: Possible request smuggling
2095002 - CVE-2022-28614 httpd: out-of-bounds read via ap_rwrite()
2095006 - CVE-2022-28615 httpd: out-of-bounds read in ap_strcmp_match()
2095012 - CVE-2022-29404 httpd: mod_lua: DoS in r:parsebody
2095015 - CVE-2022-30522 httpd: mod_sed: DoS vulnerability
2095018 - CVE-2022-30556 httpd: mod_lua: Information disclosure with websockets
2095020 - CVE-2022-31813 httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism
6. Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source:
httpd24-httpd-2.4.34-23.el7.5.src.rpm
noarch:
httpd24-httpd-manual-2.4.34-23.el7.5.noarch.rpm
ppc64le:
httpd24-httpd-2.4.34-23.el7.5.ppc64le.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.ppc64le.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.ppc64le.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_session-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.ppc64le.rpm
s390x:
httpd24-httpd-2.4.34-23.el7.5.s390x.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.s390x.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.s390x.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_session-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.s390x.rpm
x86_64:
httpd24-httpd-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_session-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source:
httpd24-httpd-2.4.34-23.el7.5.src.rpm
noarch:
httpd24-httpd-manual-2.4.34-23.el7.5.noarch.rpm
x86_64:
httpd24-httpd-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_session-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-33193
https://access.redhat.com/security/cve/CVE-2021-34798
https://access.redhat.com/security/cve/CVE-2021-36160
https://access.redhat.com/security/cve/CVE-2021-39275
https://access.redhat.com/security/cve/CVE-2021-44224
https://access.redhat.com/security/cve/CVE-2022-22719
https://access.redhat.com/security/cve/CVE-2022-22721
https://access.redhat.com/security/cve/CVE-2022-23943
https://access.redhat.com/security/cve/CVE-2022-26377
https://access.redhat.com/security/cve/CVE-2022-28614
https://access.redhat.com/security/cve/CVE-2022-28615
https://access.redhat.com/security/cve/CVE-2022-29404
https://access.redhat.com/security/cve/CVE-2022-30522
https://access.redhat.com/security/cve/CVE-2022-30556
https://access.redhat.com/security/cve/CVE-2022-31813
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/articles/6975397
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
