Vulnerability · Published Mar 14, 2022 · Assigned by apache
CVE-2022-22721core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
Critical 9.1
In plain English
A critical-severity integer overflow in Apache HTTP Server from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 41.9% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)41.9%top 1.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | httpd | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:9 | httpd-core | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | httpd-devel | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd-devel | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | httpd-filesystem | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd-filesystem | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | httpd-manual | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd-manual | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | httpd-tools | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | httpd-tools | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | mod_http2 | 1.15.7-5.module_el8.6.0+2872+fe0ff7aa | ALSA-2022:7647 |
| AlmaLinux:8 | mod_http2 | 1.15.7-5.module_el8.6.0+3031+fb177b09 | ALSA-2022:7647 |
| AlmaLinux:8 | mod_ldap | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | mod_ldap | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:9 | mod_lua | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+3031+fb177b09 | ALSA-2022:7647 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2022:7647 |
| AlmaLinux:8 | mod_proxy_html | 1:2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | mod_proxy_html | 1:2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | mod_session | 2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | mod_session | 2.4.53-7.el9 | ALSA-2022:8067 |
| AlmaLinux:8 | mod_ssl | 1:2.4.37-51.module_el8.7.0+3281+01e58653 | ALSA-2022:7647 |
| AlmaLinux:9 | mod_ssl | 1:2.4.53-7.el9 | ALSA-2022:8067 |
| Alpine:v3.20 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22721 |
| Alpine:v3.21 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22721 |
| Alpine:v3.22 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22721 |
| Alpine:v3.23 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22721 |
| Alpine:v3.24 | apache2 | 2.4.53-r0 | ALPINE-CVE-2022-22721 |
| Debian:12 | apache2 | 2.4.53-1 | DEBIAN-CVE-2022-22721 |
| Debian:13 | apache2 | 2.4.53-1 | DEBIAN-CVE-2022-22721 |
| Debian:14 | apache2 | 2.4.53-1 | DEBIAN-CVE-2022-22721 |
| Rocky Linux:8 | httpd | 0:2.4.37-51.module+el8.7.0+1059+126e9251 | RLSA-2022:7647 |
| Rocky Linux:9 | httpd | 0:2.4.53-7.el9 | RLSA-2022:8067 |
| Rocky Linux:8 | mod_http2 | 0:1.15.7-5.module+el8.6.0+823+f143cee1 | RLSA-2022:7647 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e | RLSA-2022:7647 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.4.0+553+7a69454b | RLSA-2022:7647 |
| Ubuntu:22.04:LTS | apache2 | 2.4.52-1ubuntu2 | UBUNTU-CVE-2022-22721 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | Apache HTTP Server 2.4 – through 2.4.52 |
Weakness: CWE-190
References
- https://httpd.apache.org/security/vulnerabilities_24.html x_refsource_MISC
- [oss-security] 20220314 CVE-2022-22721: Apache HTTP Server: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody mailing-list, x_refsource_MLIST
- FEDORA-2022-b4103753e9 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20220322 [SECURITY] [DLA 2960-1] apache2 security update mailing-list, x_refsource_MLIST
- FEDORA-2022-21264ec6db vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-78e3211c55 vendor-advisory, x_refsource_FEDORA
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220321-0001/ x_refsource_CONFIRM
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina mailing-list, x_refsource_FULLDISC
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6 mailing-list, x_refsource_FULLDISC
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4 mailing-list, x_refsource_FULLDISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
- https://support.apple.com/kb/HT213257 x_refsource_CONFIRM
- https://support.apple.com/kb/HT213256 x_refsource_CONFIRM
- https://support.apple.com/kb/HT213255 x_refsource_CONFIRM
- GLSA-202208-20 vendor-advisory, x_refsource_GENTOO