CVE-2022-22719
published 2022-03-14CVE-2022-22719: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52…
PriorityP260high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
69.10%
99.4th percentile
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | <= 2.4.52 | — |
| apache_software_foundation | apache_http_server | Apache HTTP Server 2.4 – 2.4.52 | — |
| apple | mac_os_x | — | — |
| apple | macos | < 10.15.7 | 10.15.7 |
| apple | macos | >= 11.0 < 11.6.6 | 11.6.6 |
| apple | macos | >= 12.0.0 < 12.4 | 12.4 |
| apple | macos_big_sur | — | — |
| apple | macos_monterey | — | — |
| apple | security_update_2022-004_catalina | — | — |
| debian | apache2 | < apache2 2.4.53-1 (bookworm) | apache2 2.4.53-1 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_httpd_2.4.53-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_httpd_2.4.53-1_on_cbl_mariner_1.0 | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | zfs_storage_appliance_kit | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability resides specifically in the mod_lua module's parsebody function — target detection at crafted request bodies sent to servers with mod_lua enabled ↗
- →Apache HTTP Server versions 2.4.52 and earlier are affected; alert on these version strings in server banners or software inventory ↗
- →Monitor for Apache httpd process crashes (denial of service) originating from mod_lua request body processing — unexpected httpd worker crashes may indicate exploitation attempts ↗
- →The highest impact is to availability (DoS); correlate sudden httpd worker crashes with inbound HTTP requests containing unusual or malformed body content ↗
- ·httpd as shipped with Red Hat Enterprise Linux 6 is NOT affected because it does not ship mod_lua — scope detection efforts accordingly ↗
- ·Disabling mod_lua and restarting httpd is a valid mitigation — verify mod_lua is loaded before treating a host as vulnerable ↗
- ·The vulnerability is triggered via the r:parsebody Lua API — only endpoints that invoke parsebody in Lua scripts are exploitable attack surfaces ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
apache2 vulnerabilities
osv·2022-03-17·CVSS 7.5
CVE-2022-22719 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
Chamal De Silva discovered that the Apache HTTP Server mod_lua module
incorrectly handled certain crafted request bodies. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2022-22719)
James Kettle discovered that the Apache HTTP Server incorrectly closed
inbound connection when certain errors are encountered. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-22720)
It was discovered that the Apache HTTP Server incorrectly handled large
LimitXMLRequestBody settings on certain platforms. In certain
configurations, a remote attacker could use this issue to cause the server
to crash, resulting in a denial of service, or possibly execute arbitrary
co
OSV
apache2 vulnerabilities
osv·2022-03-17·CVSS 7.5
CVE-2022-22719 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
USN-5333-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Chamal De Silva discovered that the Apache HTTP Server mod_lua module
incorrectly handled certain crafted request bodies. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2022-22719)
James Kettle discovered that the Apache HTTP Server incorrectly closed
inbound connection when certain errors are encountered. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-22720)
It was discovered that the Apache HTTP Server incorrectly handled large
LimitXMLRequestBody settings on certain pla
GHSA
GHSA-2349-9g3v-jxmj: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash
ghsa_unreviewed·2022-03-15
CVE-2022-22719 [HIGH] CWE-665 GHSA-2349-9g3v-jxmj: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
OSV
CVE-2022-22719: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash
osv·2022-03-14·CVSS 7.5
CVE-2022-22719 [HIGH] CVE-2022-22719: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
Apple
CVE-2022-22719: Security Update 2022-004 Catalina
vendor_apple·2022-05-16·CVSS 7.5
CVE-2022-22719 [HIGH] CVE-2022-22719: Security Update 2022-004 Catalina
Apple Security Update: About the security content of Security Update 2022-004 Catalina
Product: Security Update 2022-004 Catalina
CVE: CVE-2022-22719
Component: CVE-2022-22719
Apple
CVE-2022-22719: macOS Big Sur 11.6.6
vendor_apple·2022-05-16·CVSS 7.5
CVE-2022-22719 [HIGH] CVE-2022-22719: macOS Big Sur 11.6.6
Apple Security Update: About the security content of macOS Big Sur 11.6.6
Product: macOS Big Sur
Version: 11.6.6
CVE: CVE-2022-22719
Component: CVE-2022-22719
Apple
CVE-2022-22719: macOS Monterey 12.4
vendor_apple·2022-05-16·CVSS 7.5
CVE-2022-22719 [HIGH] CVE-2022-22719: macOS Monterey 12.4
Apple Security Update: About the security content of macOS Monterey 12.4
Product: macOS Monterey
Version: 12.4
CVE: CVE-2022-22719
Component: CVE-2022-22719
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2022-03-17·CVSS 7.5
CVE-2022-22721 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
USN-5333-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Chamal De Silva discovered that the Apache HTTP Server mod_lua module
incorrectly handled certain crafted request bodies. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2022-22719)
James Kettle discovered that the Apache HTTP Server incorrectly closed
inbound connection when certain errors are encountered. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-22720)
It was discovered that the Ap
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2022-03-17·CVSS 7.5
CVE-2022-22719 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
Chamal De Silva discovered that the Apache HTTP Server mod_lua module
incorrectly handled certain crafted request bodies. A remote attacker could
possibly use this issue to cause the server to crash, resulting in a denial
of service. (CVE-2022-22719)
James Kettle discovered that the Apache HTTP Server incorrectly closed
inbound connection when certain errors are encountered. A remote attacker
could possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-22720)
It was discovered that the Apache HTTP Server incorrectly handled large
LimitXMLRequestBody settings on certain platforms. In certain
configurations, a remote attacker could use this issue to cause t
Red Hat
httpd: mod_lua: Use of uninitialized value of in r:parsebody
vendor_redhat·2022-03-14·CVSS 7.5
CVE-2022-22719 [HIGH] CWE-908 httpd: mod_lua: Use of uninitialized value of in r:parsebody
httpd: mod_lua: Use of uninitialized value of in r:parsebody
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
A flaw was found in the mod_lua module of httpd. A crafted request body can cause a read to a random memory area due to an uninitialized value in functions called by the parsebody function. The highest threat from this vulnerability is to system availability.
Statement: httpd as shipped with Red Hat Enterprise Linux 6, is not affected by this flaw because it does not ship mod_lua.
Mitigation: Disabling mod_lua and restarting httpd will mitigate this flaw. See https://access.redhat.com/articles/10649 for more information.
Package: httpd (Red Hat Enterprise
Microsoft
mod_lua Use of uninitialized value of in r:parsebody
vendor_msrc·2022-03-08·CVSS 7.5
CVE-2022-22719 [HIGH] CWE-665 mod_lua Use of uninitialized value of in r:parsebody
mod_lua Use of uninitialized value of in r:parsebody
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.
Debian
CVE-2022-22719: apache2 - A carefully crafted request body can cause a read to a random memory area which ...
vendor_debian·2022·CVSS 7.5
CVE-2022-22719 [HIGH] CVE-2022-22719: apache2 - A carefully crafted request body can cause a read to a random memory area which ...
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
Scope: local
bookworm: resolved (fixed in 2.4.53-1)
bullseye: resolved (fixed in 2.4.53-1~deb11u1)
forky: resolved (fixed in 2.4.53-1)
sid: resolved (fixed in 2.4.53-1)
trixie: resolved (fixed in 2.4.53-1)
No detection rules found.
No public exploits indexed.
HackerOne
Use of uninitialized value of in req_parsebody method of lua_request.c
hackerone·2022-03-17
[MEDIUM] Use of uninitialized value of in req_parsebody method of lua_request.c
Use of uninitialized value of in req_parsebody method of lua_request.c
###Software Versions
Ubuntu - 18.04 64-bit
Apache 2.4.51 - 64 bit
### Cause of Bug
This bug is present in the `req_parsebody` method of lua_request.c file.
Below mentioned lines of code cause this bug.
```cpp
const char *data;
int i;
size_t vlen = 0;
size_t len = 0;
if (lua_read_body(r, &data, (apr_off_t*) &size, max_post_size) != OK) {
return 2;
}
len = strlen(multipart);
i = 0;
for
(
start = strstr((char *) data, multipart);
```
Note that the `const char *data` pointer is not initialized with a value.
That pointer is passed to the `lua_read_body` method to store data sent by HTTP request.
If the HTTP request does not contain any data, then a value will not be set for `const char *data` pointer.
So `const char *data
Bugzilla
CVE-2022-22719 httpd: mod_lua: Use of uninitialized value of in r:parsebody
bugzilla·2022-03-15·CVSS 7.5
CVE-2022-22719 [HIGH] CVE-2022-22719 httpd: mod_lua: Use of uninitialized value of in r:parsebody
CVE-2022-22719 httpd: mod_lua: Use of uninitialized value of in r:parsebody
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
References:
https://httpd.apache.org/security/vulnerabilities_24.html
https://www.openwall.com/lists/oss-security/2022/03/14/4
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 2064578]
---
Upstream patch:
https://svn.apache.org/viewvc?view=revision&revision=1898694
---
This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 7
Via RHSA-2022:6753 https://access.redhat.com/errata/RHSA-2022:6753
---
This issue has been addressed in the following pr
CTF
Jacob the Boss / Readme
ctf_writeups·CVSS 9.8
CVE-2023-38408 [CRITICAL] Jacob the Boss / Readme
# [Jacob the Boss - TryHackMe writeup](https://tryhackme.com/room/jacobtheboss)
Find a way in and learn a little more.
## Task 1
Well, the flaw that makes up this box is the reproduction found in the production environment of a customer a while ago, the verification in season consisted of two steps, the last one within the environment, we hit it head-on and more than 15 machines were vulnerable that together with the development team we were able to correct and adapt.
*First of all, add the jacobtheboss.box address to your hosts file.*
Anyway, learn a little more, have fun!
Answer the questions below
### user.txt
```
f4d491f280de360cc49e26ca1587cbcc
```
### root.txt
```
29a5641eaa0c01abe5749608c8232806
```
## Initial Enumeration
I started with a full port and service scan usi
http://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38http://www.openwall.com/lists/oss-security/2022/03/14/4https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20220321-0001/https://support.apple.com/kb/HT213255https://support.apple.com/kb/HT213256https://support.apple.com/kb/HT213257https://www.oracle.com/security-alerts/cpuapr2022.htmlhttp://seclists.org/fulldisclosure/2022/May/33http://seclists.org/fulldisclosure/2022/May/35http://seclists.org/fulldisclosure/2022/May/38http://www.openwall.com/lists/oss-security/2022/03/14/4https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20220321-0001/https://support.apple.com/kb/HT213255https://support.apple.com/kb/HT213256https://support.apple.com/kb/HT213257https://www.oracle.com/security-alerts/cpuapr2022.html
2022-03-14
Published