The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8067 advisory.

  - A carefully crafted request body can cause a read to a random memory area which could cause the process to     crash. This issue affects Apache HTTP Server 2.4.52 and earlier. (CVE-2022-22719)

  - If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems     an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server     2.4.52 and earlier. (CVE-2022-22721)

  - Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap     memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and     prior versions. (CVE-2022-23943)

  - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of     Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This     issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    (CVE-2022-26377)

  - The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an     attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with     mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use     the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against     current headers to resolve the issue. (CVE-2022-28614)

  - Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in     ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the     server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may     hypothetically be affected. (CVE-2022-28615)

  - In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0)     may cause a denial of service due to no default limit on possible input size. (CVE-2022-29404)

  - If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input     to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
    (CVE-2022-30522)

  - Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point     past the end of the storage allocated for the buffer. (CVE-2022-30556)

  - Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on     client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on     the origin server/application. (CVE-2022-31813)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

  - Denial of Service mod_sed: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in     contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory     allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog     Security Research team

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the httpd package has been released.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0144 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2006-20001:
    A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool     (heap) memory location beyond the header value sent. This could cause the process to crash. This issue     affects Apache HTTP Server 2.4.54 and earlier.

    CVE-2022-22719:
    A carefully crafted request body can cause a read to a random memory area which could cause the process to     crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

    CVE-2022-22721:
    If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems     an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server     2.4.52 and earlier.

    CVE-2022-23943:
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap     memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and     prior versions.

    CVE-2022-26377:
    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of     Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This     issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

    CVE-2022-28614:
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an     attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with     mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use     the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against     current headers to resolve the issue.

    CVE-2022-29404:
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0)     may cause a denial of service due to no default limit on possible input size.

    CVE-2022-30556:
    Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point     past the end of the storage allocated for the buffer.

    CVE-2022-31813:
    Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on     client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on     the origin server/application.

    CVE-2022-28615:
    Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in     ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the     server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may     hypothetically be affected.

    CVE-2022-30522:
    If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input     to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

    CVE-2022-36760:
    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of     Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to.  This     issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.

    CVE-2022-37436:
    Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated     early, resulting in some headers being incorporated into the response body. If the later headers have any     security purpose, they will not be interpreted by the client.

    CVE-2023-25690:
    Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request     Smuggling attack.
    Configurations are affected when mod_proxy is enabled along with some form of RewriteRule     or ProxyPassMatch in which a non-specific pattern matches     some portion of the user-supplied request-target (URL) data and is then     re-inserted into the proxied request-target using variable     substitution. For example, something like:
    RewriteEngine on     RewriteRule ^/here/(.*) http://example.com:8080/elsewhere?$1; [P]     ProxyPassReverse /here/ http://example.com:8080/     Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying     unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at     least version 2.4.56 of Apache HTTP Server.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
167961	AlmaLinux 9 : httpd (ALSA-2022:8067)	Nessus	Alma Linux Local Security Checks	11/19/2022	10/3/2023	critical
193423	Apache 2.4.x < 2.4.54 Multiple Vulnerabilities	Nessus	Web Servers	4/17/2024	4/18/2024	high
203494	Photon OS 4.0: Httpd PHSA-2022-4.0-0202	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	critical
236382	Alibaba Cloud Linux 3 : 0144: httpd:2.4 (ALINUX3-SA-2023:0144)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical