CVE-2022-26377

mod_proxy_ajp: Possible request smuggling

Summary

Original description

The description as published by the source.

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami apache

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.54"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2022-26377 apache2 Fixed in: 2.4.54-r0
Debian DEBIAN-CVE-2022-26377 apache2 Fixed in: 2.4.54-1~deb11u1

References

advisory openwall.com
advisory httpd.apache.org
advisory lists.fedoraproject.org
advisory lists.fedoraproject.org
advisory security.gentoo.org
advisory security.netapp.com
web nvd.nist.gov