CVE-2022-22720

HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

Description

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

Scores

Faiblesses (CWE)

• CWE-444

Références européennes

• ENISA EUVD · EUVD-2022-27863
• GCVE · GCVE-0-2022-22720

Avis du CERT-FR

• CERTFR-2024-AVI-0575 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
• CERTFR-2023-AVI-0051 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
• CERTFR-2022-AVI-767 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2022-AVI-467 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
• CERTFR-2022-AVI-466 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
• CERTFR-2022-AVI-241 — Multiples vulnérabilités dans Apache HTTP Server · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* ≤ 2.4.52
• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*
• cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* < 10.15.7
• cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 11.0 < 11.6.6
• cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 12.0 ≤ 12.4

Produits affectés

Références

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2022/03/14/3
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/
• https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://security.netapp.com/advisory/ntap-20220321-0001/
• http://seclists.org/fulldisclosure/2022/May/33
• http://seclists.org/fulldisclosure/2022/May/35
• http://seclists.org/fulldisclosure/2022/May/38
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://support.apple.com/kb/HT213257
• https://support.apple.com/kb/HT213256
• https://support.apple.com/kb/HT213255
• https://security.gentoo.org/glsa/202208-20

Sources