Rocky Linux 9 : httpd (RLSA-2022:8067)

critical Nessus Plugin ID 170713

Synopsis

The remote Rocky Linux host is missing one or more security updates.

Description

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8067 advisory.

- Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. (CVE-2022-31813)

- A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier. (CVE-2022-22719)

- If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier. (CVE-2022-22721)

- Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions. (CVE-2022-23943)

- Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
(CVE-2022-26377)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://errata.rockylinux.org/RLSA-2022:8067

https://bugzilla.redhat.com/show_bug.cgi?id=2064319

https://bugzilla.redhat.com/show_bug.cgi?id=2064320

https://bugzilla.redhat.com/show_bug.cgi?id=2064322

https://bugzilla.redhat.com/show_bug.cgi?id=2073459

https://bugzilla.redhat.com/show_bug.cgi?id=2075406

https://bugzilla.redhat.com/show_bug.cgi?id=2079939

https://bugzilla.redhat.com/show_bug.cgi?id=2094997

https://bugzilla.redhat.com/show_bug.cgi?id=2095002

https://bugzilla.redhat.com/show_bug.cgi?id=2095006

https://bugzilla.redhat.com/show_bug.cgi?id=2095012

https://bugzilla.redhat.com/show_bug.cgi?id=2095015

https://bugzilla.redhat.com/show_bug.cgi?id=2095018

https://bugzilla.redhat.com/show_bug.cgi?id=2095020

https://bugzilla.redhat.com/show_bug.cgi?id=2095838

Plugin Details

Severity: Critical

ID: 170713

File Name: rocky_linux_RLSA-2022-8067.nasl

Version: 1.4

Type: local

Published: 1/27/2023

Updated: 11/6/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2022-31813

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:rocky:linux:mod_lua, p-cpe:/a:rocky:linux:httpd-filesystem, p-cpe:/a:rocky:linux:httpd-devel, p-cpe:/a:rocky:linux:mod_ssl, p-cpe:/a:rocky:linux:mod_proxy_html-debuginfo, p-cpe:/a:rocky:linux:mod_ssl-debuginfo, p-cpe:/a:rocky:linux:httpd, p-cpe:/a:rocky:linux:mod_lua-debuginfo, p-cpe:/a:rocky:linux:mod_ldap-debuginfo, p-cpe:/a:rocky:linux:httpd-manual, p-cpe:/a:rocky:linux:mod_proxy_html, p-cpe:/a:rocky:linux:httpd-core-debuginfo, p-cpe:/a:rocky:linux:httpd-tools-debuginfo, p-cpe:/a:rocky:linux:httpd-core, p-cpe:/a:rocky:linux:httpd-debuginfo, cpe:/o:rocky:linux:9, p-cpe:/a:rocky:linux:mod_ldap, p-cpe:/a:rocky:linux:mod_session-debuginfo, p-cpe:/a:rocky:linux:httpd-debugsource, p-cpe:/a:rocky:linux:httpd-tools, p-cpe:/a:rocky:linux:mod_session

Required KB Items: Host/local_checks_enabled, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/26/2023

Vulnerability Publication Date: 1/26/2023

Reference Information

CVE: CVE-2022-22719, CVE-2022-22721, CVE-2022-23943, CVE-2022-26377, CVE-2022-28614, CVE-2022-28615, CVE-2022-29404, CVE-2022-30522, CVE-2022-30556, CVE-2022-31813