Vulnerability · Published Mar 14, 2022 · Assigned by apache
CVE-2022-22719mod_lua Use of uninitialized value of in r:parsebody
High 7.5
In plain English
A high-severity security flaw in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 69.8% (higher than 99.4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)69.8%top 0.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:9 | httpd-core | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | httpd-devel | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd-devel | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd-filesystem | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | httpd-manual | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd-manual | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | httpd-tools | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd-tools | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | mod_http2 | 1.15.7-5.module_el8.6.0+2872+fe0ff7aa | ALSA-2022:7647 |
| AlmaLinux:8 | mod_http2 | 1.15.7-5.module_el8.6.0+3031+fb177b09 | ALSA-2022:7647 |
| AlmaLinux:8 | mod_ldap | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | mod_ldap | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:9 | mod_lua | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+3031+fb177b09 | ALSA-2022:7647 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2022:7647 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | mod_proxy_html | 1:2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | mod_session | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | mod_session | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | mod_ssl | 1:2.4.53-7.el9 | ALSA-2022:8067 |
| Alpine:v3.20 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22719 |
| Alpine:v3.21 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22719 |
| Alpine:v3.22 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22719 |
| Alpine:v3.23 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22719 |
| Alpine:v3.24 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22719 |
| Debian:12 | apache2 | 2.4.53-1 | DEBIAN-CVE-2022-22719 |
| Debian:13 | apache2 | 2.4.53-1 | DEBIAN-CVE-2022-22719 |
| Debian:14 | apache2 | 2.4.53-1 | DEBIAN-CVE-2022-22719 |
| Rocky Linux:8 | httpd | 0:2.4.37-51.module+el8.7.0+1059+126e9251 | RLSA-2022:7647 |
| Rocky Linux:9 | httpd | 0:2.4.53-7.el9 | RLSA-2022:8067 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-5.module+el8.6.0+823+f143cee1 | RLSA-2022:7647 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e | RLSA-2022:7647 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.4.0+553+7a69454b | RLSA-2022:7647 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu2 | UBUNTU-CVE-2022-22719 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | Apache HTTP Server 2.4 – through 2.4.52 |
Weakness: CWE-665
References
- https://httpd.apache.org/security/vulnerabilities_24.html x_refsource_MISC
- [oss-security] 20220314 CVE-2022-22719: Apache HTTP Server: mod_lua Use of uninitialized value of in r:parsebody mailing-list, x_refsource_MLIST
- FEDORA-2022-b4103753e9 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20220322 [SECURITY] [DLA 2960-1] apache2 security update mailing-list, x_refsource_MLIST
- FEDORA-2022-21264ec6db vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-78e3211c55 vendor-advisory, x_refsource_FEDORA
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220321-0001/ x_refsource_CONFIRM
- https://support.apple.com/kb/HT213257 x_refsource_CONFIRM
- https://support.apple.com/kb/HT213256 x_refsource_CONFIRM
- https://support.apple.com/kb/HT213255 x_refsource_CONFIRM
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina mailing-list, x_refsource_FULLDISC
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6 mailing-list, x_refsource_FULLDISC
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4 mailing-list, x_refsource_FULLDISC
- GLSA-202208-20 vendor-advisory, x_refsource_GENTOO