CVE-2022-22721

core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami apache

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.53"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2022-22721 apache2 Corrigé dans: 2.4.53-r0
Debian DEBIAN-CVE-2022-22721 apache2 Corrigé dans: 2.4.53-1~deb11u1

Références

advisory seclists.org
advisory seclists.org
advisory seclists.org
advisory openwall.com
advisory httpd.apache.org
advisory lists.debian.org
advisory security.gentoo.org
advisory security.netapp.com
advisory support.apple.com
advisory support.apple.com
advisory support.apple.com
advisory oracle.com
advisory oracle.com
web lists.fedoraproject.org
web lists.fedoraproject.org
web lists.fedoraproject.org
web nvd.nist.gov