CVE-2022-36760

Apache HTTP Server: mod_proxy_ajp Possible request smuggling

Summary

Original description

The description as published by the source.

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami apache

[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.55"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2022-36760 apache2 Fixed in: 2.4.55-r0
Debian DEBIAN-CVE-2022-36760 apache2 Fixed in: 2.4.56-1~deb11u1
Ubuntu UBUNTU-CVE-2022-36760 apache2

References

advisory httpd.apache.org
web security.gentoo.org
web nvd.nist.gov