CVE-2022-22721

critical

Description

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

References

https://www.oracle.com/security-alerts/cpujul2022.html

https://www.oracle.com/security-alerts/cpuapr2022.html

https://support.apple.com/kb/HT213257

https://support.apple.com/kb/HT213256

https://support.apple.com/kb/HT213255

https://security.netapp.com/advisory/ntap-20220321-0001/

https://security.gentoo.org/glsa/202208-20

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/

https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html

http://www.openwall.com/lists/oss-security/2022/03/14/2

http://seclists.org/fulldisclosure/2022/May/38

http://seclists.org/fulldisclosure/2022/May/35

http://seclists.org/fulldisclosure/2022/May/33

https://support.apple.com/en-us/HT213256

https://support.apple.com/en-us/102770

https://httpd.apache.org/security/vulnerabilities_24.html

Details

Source: Mitre, NVD

Published: 2022-03-14

Updated: 2024-11-21

Risk Information

CVSS v2

Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.23333

Detections

Analytics