The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 49adfbe5-e7d1-11ec-8fbd-d4c9ef517024 advisory.

  - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of     Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This     issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    (CVE-2022-26377)

  - Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process     requests with the mod_isapi module. (CVE-2022-28330)

  - The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an     attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with     mod_luas r:puts() function. (CVE-2022-28614)

  - Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in     ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the     server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may     hypothetically be affected. (CVE-2022-28615)

  - In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0)     may cause a denial of service due to no default limit on possible input size. (CVE-2022-29404)

  - If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input     to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
    (CVE-2022-30522)

  - Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point     past the end of the storage allocated for the buffer. (CVE-2022-30556)

  - Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on     client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on     the origin server/application. (CVE-2022-31813)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd24 installed on the remote host is prior to 2.4.54-1.98. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1607 advisory.

    An HTTP request smuggling vulnerability was found in the mod_proxy_ajp module of httpd. This flaw allows     an attacker to smuggle requests to the AJP server, where it forwards requests. (CVE-2022-26377)

    An out-of-bounds read vulnerability was found in the mod_isapi module of httpd. The issue occurs when     httpd is configured to process requests with the mod_isapi module. (CVE-2022-28330)

    An out-of-bounds read vulnerability was found in httpd. A very large input to the ap_rputs and ap_rwrite     functions can lead to an integer overflow and result in an out-of-bounds read. (CVE-2022-28614)

    An out-of-bounds read vulnerability was found in httpd. A very large input to the ap_strcmp_match function     can lead to an integer overflow and result in an out-of-bounds read. (CVE-2022-28615)

    A flaw was found in the mod_lua module of httpd. A malicious request to a Lua script that calls     parsebody(0) can lead to a denial of service due to no default limit on the possible input size.
    (CVE-2022-29404)

    A flaw was found in the mod_sed module of httpd. A very large input to the mod_sed module can result in a     denial of service due to excessively large memory allocations. (CVE-2022-30522)

    A flaw was found in the mod_lua module of httpd. The data returned by the wsread function may point past     the end of the storage allocated for the buffer, resulting in information disclosure. (CVE-2022-30556)

    A flaw was found in the mod_proxy module of httpd. The server may remove the X-Forwarded-* headers from a     request based on the client-side Connection header hop-by-hop mechanism. (CVE-2022-31813)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

  - Read beyond bounds via ap_rwrite(): The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may     read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite()     or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project     would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

  - Read beyond bounds in ap_strcmp_match(): Apache HTTP Server 2.4.53 and earlier may crash or disclose     information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input     buffer.  While no code distributed with the server can be coerced into such a call, third-party modules or     lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP     Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8840 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged     under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent     update experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.51 Service Pack 1 serves as a     replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.51, and includes bug fixes and     enhancements, which are documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)

    * openssl: c_rehash script allows command injection (CVE-2022-1292)

    * openssl: the c_rehash script allows command injection (CVE-2022-2068)

    * httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)

    * httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)

    * httpd: mod_sed: DoS vulnerability (CVE-2022-30522)

    * httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)

    * curl: HTTP compression denial of service (CVE-2022-32206)

    * curl: Unpreserved file permissions (CVE-2022-32207)

    * curl: FTP-KRB bad message verification (CVE-2022-32208)

    * curl: POST following PUT confusion (CVE-2022-32221)

    * curl: HTTP proxy double-free (CVE-2022-42915)

    * curl: HSTS bypass via IDN (CVE-2022-42916)

    * curl: CERTINFO never-ending busy-loop (CVE-2022-27781)

    * httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)

    * httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)

    * curl: control code in cookie denial of service (CVE-2022-35252)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of IBM Aspera Faspex running on the remote web server is prior to 4.4.2 Patch Level 2. It is, therefore, affected by multiple vulnerabilities, including:

    - IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the       system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could       exploit this vulnerability to execute arbitrary code on the system. (CVE-2022-47986)

    - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant       matches. (CVE-2018-25032)

    - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache       HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. (CVE-2022-26377)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
161984	FreeBSD : Apache httpd -- Multiple vulnerabilities (49adfbe5-e7d1-11ec-8fbd-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	6/9/2022	10/25/2023	critical
162833	Amazon Linux AMI : httpd24 (ALAS-2022-1607)	Nessus	Amazon Linux Local Security Checks	7/8/2022	12/11/2024	critical
161948	Apache 2.4.x < 2.4.54 Multiple Vulnerabilities	Nessus	Web Servers	6/8/2022	4/18/2024	critical
168498	RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 (RHSA-2022:8840)	Nessus	Red Hat Local Security Checks	12/8/2022	11/7/2024	critical
173033	IBM Aspera Faspex < 4.4.2 Patch Level 2 Multiple Vulnerabilities	Nessus	CGI abuses	3/20/2023	3/21/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical