Debian Apache2 vulnerabilities

CVE-2022-30522 [HIGH] CVE-2022-30522: apache2 - If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in... If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Scope: local bookworm: resolved (fixed in 2.4.54-1) bullseye: resolved (fixed in 2.4.54-1~deb11u1) forky: resolved (fixed in 2.4.54-1) sid: resolved (fixed

CVE-2022-30556 [HIGH] CVE-2022-30556: apache2 - Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling... Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Scope: local bookworm: resolved (fixed in 2.4.54-1) bullseye: resolved (fixed in 2.4.54-1~deb11u1) forky: resolved (fixed in 2.4.54-1) sid: resolved (fixed in 2.4.54-1) trixie: resolved (fixed in 2.4.54-1)

CVE-2022-29404 [HIGH] CVE-2022-29404: apache2 - In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script th... In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Scope: local bookworm: resolved (fixed in 2.4.54-1) bullseye: resolved (fixed in 2.4.54-1~deb11u1) forky: resolved (fixed in 2.4.54-1) sid: resolved (fixed in 2.4.54-1) trixie: resolved

CVE-2022-26377 [HIGH] CVE-2022-26377: apache2 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerab... Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Scope: local bookworm: resolved (fixed in 2.4.54-1) bullseye: res

CVE-2022-28614 [MEDIUM] CVE-2022-28614: apache2 - The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unint... The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_

CVE-2022-37436 [MEDIUM] CVE-2022-37436: apache2 - Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response h... Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. Scope: local bookworm: resolved (fixed in 2.4.55-1) bullseye: resolved (fixed in 2.4.56-1~deb11

CVE-2022-28330 [MEDIUM] CVE-2022-28330: apache2 - Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when con... Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2021-42013 [CRITICAL] CVE-2021-42013: apache2 - It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was in... It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If

CVE-2021-26691 [CRITICAL] CVE-2021-26691: apache2 - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader... In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow Scope: local bookworm: resolved (fixed in 2.4.46-6) bullseye: resolved (fixed in 2.4.46-6) forky: resolved (fixed in 2.4.46-6) sid: resolved (fixed in 2.4.46-6) trixie: resolved (fixed in 2.4.46-6)

CVE-2021-39275 [CRITICAL] CVE-2021-39275: apache2 - ap_escape_quotes() may write beyond the end of a buffer when given malicious inp... ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier. Scope: local bookworm: resolved (fixed in 2.4.49-1) bullseye: resolved (fixed in 2.4.51-1~deb11u1) forky: resolved (fixed

CVE-2021-44790 [CRITICAL] CVE-2021-44790: apache2 - A carefully crafted request body can cause a buffer overflow in the mod_lua mult... A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. Scope: local bookworm: resolved (fixed in 2.4.52-1) bullseye

CVE-2021-40438 [CRITICAL] CVE-2021-40438: apache2 - A crafted request uri-path can cause mod_proxy to forward the request to an orig... A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. Scope: local bookworm: resolved (fixed in 2.4.49-1) bullseye: resolved (fixed in 2.4.51-1~deb11u1) forky: resolved (fixed in 2.4.49-1) sid: resolved (fixed in 2.4.49-1) trixie: resolved (f

CVE-2021-41773 [CRITICAL] CVE-2021-41773: apache2 - A flaw was found in a change made to path normalization in Apache HTTP Server 2.... A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI sc

CVE-2021-33193 [HIGH] CVE-2021-33193: apache2 - A crafted method sent through HTTP/2 will bypass validation and be forwarded by ... A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48. Scope: local bookworm: resolved (fixed in 2.4.48-4) bullseye: resolved (fixed in 2.4.48-3.1+deb11u1) forky: resolved (fixed in 2.4.48-4) sid: resolved (fixed in 2.4.

CVE-2021-44224 [HIGH] CVE-2021-44224: apache2 - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can... A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (include

CVE-2021-26690 [HIGH] CVE-2021-26690: apache2 - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header ha... Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service Scope: local bookworm: resolved (fixed in 2.4.46-6) bullseye: resolved (fixed in 2.4.46-6) forky: resolved (fixed in 2.4.46-6) sid: resolved (fixed in 2.4.46-6) trixie: resolved (

CVE-2021-31618 [HIGH] CVE-2021-31618: apache2 - Apache HTTP Server protocol handler for the HTTP/2 protocol checks received requ... Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully ini

CVE-2021-36160 [HIGH] CVE-2021-36160: apache2 - A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the... A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive). Scope: local bookworm: resolved (fixed in 2.4.49-1) bullseye: resolved (fixed in 2.4.51-1~deb11u1) forky: resolved (fixed in 2.4.49-1) sid: resolved (fixed in 2.4.49-1) trixie:

CVE-2021-41524 [HIGH] CVE-2021-41524: apache2 - While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected duri... While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project. Scope: local bookworm: resolved (fixed in 2.4.50-1) bullseye: resolved

CVE-2021-34798 [HIGH] CVE-2021-34798: apache2 - Malformed requests may cause the server to dereference a NULL pointer. This issu... Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. Scope: local bookworm: resolved (fixed in 2.4.49-1) bullseye: resolved (fixed in 2.4.51-1~deb11u1) forky: resolved (fixed in 2.4.49-1) sid: resolved (fixed in 2.4.49-1) trixie: resolved (fixed in 2.4.49-1)