CVE-2022-22721

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

History

17 May 2022, 07:15

Type Values Removed Values Added
References
  • (FULLDISC) http://seclists.org/fulldisclosure/2022/May/33 -
  • (FULLDISC) http://seclists.org/fulldisclosure/2022/May/35 -
  • (FULLDISC) http://seclists.org/fulldisclosure/2022/May/38 -

16 May 2022, 20:15

Type Values Removed Values Added
References
  • (CONFIRM) https://support.apple.com/kb/HT213256 -
  • (CONFIRM) https://support.apple.com/kb/HT213257 -
  • (CONFIRM) https://support.apple.com/kb/HT213255 -

20 Apr 2022, 00:16

Type Values Removed Values Added
References
  • (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html -

18 Apr 2022, 18:56

Type Values Removed Values Added
First Time Debian
Debian debian Linux
Fedoraproject fedora
Fedoraproject
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ - Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ - Mailing List, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220321-0001/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220321-0001/ - Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

26 Mar 2022, 19:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ -

26 Mar 2022, 00:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ -

22 Mar 2022, 10:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html -

22 Mar 2022, 06:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ -

21 Mar 2022, 15:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220321-0001/ -

18 Mar 2022, 18:59

Type Values Removed Values Added
References (MISC) https://httpd.apache.org/security/vulnerabilities_24.html - (MISC) https://httpd.apache.org/security/vulnerabilities_24.html - Vendor Advisory
References (MLIST) http://www.openwall.com/lists/oss-security/2022/03/14/2 - (MLIST) http://www.openwall.com/lists/oss-security/2022/03/14/2 - Mailing List, Third Party Advisory
First Time Apache http Server
Apache
CVSS v2 : unknown
v3 : unknown
v2 : 6.8
v3 : 9.8
CPE cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
CWE CWE-190

14 Mar 2022, 15:51

Type Values Removed Values Added
References
  • (MLIST) http://www.openwall.com/lists/oss-security/2022/03/14/2 -

14 Mar 2022, 11:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-03-14 11:15

Updated : 2022-05-17 07:15


NVD link : CVE-2022-22721

Mitre link : CVE-2022-22721


JSON object : View

Products Affected

debian

  • debian_linux

fedoraproject

  • fedora

apache

  • http_server
CWE
CWE-190

Integer Overflow or Wraparound