CVE-2022-22721
core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
Summary
core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
Original description
The description as published by the source.
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
Affected packages
Bitnami
apache
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.53"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2022-22721 apache2 Fixed in: 2.4.53-r0
- Debian DEBIAN-CVE-2022-22721 apache2 Fixed in: 2.4.53-1~deb11u1
References
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- web seclists.org
- web seclists.org
- web seclists.org
- web openwall.com
- web httpd.apache.org
- web lists.debian.org
- web support.apple.com
- web support.apple.com
- web support.apple.com
- web oracle.com
- web oracle.com