CVE-2022-22721

core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

Description

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

Scores

Weaknesses (CWE)

• CWE-190

European references

• ENISA EUVD · EUVD-2022-27864
• GCVE · GCVE-0-2022-22721

CERT-FR advisories

• CERTFR-2024-AVI-0575 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
• CERTFR-2022-AVI-467 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
• CERTFR-2022-AVI-466 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
• CERTFR-2022-AVI-241 — Multiples vulnérabilités dans Apache HTTP Server · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* ≤ 2.4.52
• cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* ≥ 10.15 < 10.15.7
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*
• cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 11.0 < 11.6.6
• cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 12.0 < 12.4

Affected products

References

• https://httpd.apache.org/security/vulnerabilities_24.html
• http://www.openwall.com/lists/oss-security/2022/03/14/2
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/
• https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://security.netapp.com/advisory/ntap-20220321-0001/
• http://seclists.org/fulldisclosure/2022/May/33
• http://seclists.org/fulldisclosure/2022/May/35
• http://seclists.org/fulldisclosure/2022/May/38
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://support.apple.com/kb/HT213257
• https://support.apple.com/kb/HT213256
• https://support.apple.com/kb/HT213255
• https://security.gentoo.org/glsa/202208-20

Sources