CVE-2022-22720

Опубликовано: 14 мар. 2022

Источник: redhat

CVSS3: 8.3

EPSS Средний

Описание

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

A flaw was found in httpd. The inbound connection is not closed when it fails to discard the request body, which may expose the server to HTTP request smuggling.

Меры по смягчению последствий

There are currently no known mitigations for this issue.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat Enterprise Linux 9	httpd	Not affected
Red Hat JBoss Enterprise Application Platform 6	httpd	Out of support scope
JBoss Core Services for RHEL 8	jbcs-httpd24-apr-util	Fixed	RHSA-2022:1389	20.04.2022
JBoss Core Services for RHEL 8	jbcs-httpd24-curl	Fixed	RHSA-2022:1389	20.04.2022
JBoss Core Services for RHEL 8	jbcs-httpd24-httpd	Fixed	RHSA-2022:1389	20.04.2022
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_cluster-native	Fixed	RHSA-2022:1389	20.04.2022
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_http2	Fixed	RHSA-2022:1389	20.04.2022
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_jk	Fixed	RHSA-2022:1389	20.04.2022
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_md	Fixed	RHSA-2022:1389	20.04.2022
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_security	Fixed	RHSA-2022:1389	20.04.2022

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Important

Дефект:

CWE-444

https://bugzilla.redhat.com/show_bug.cgi?id=2064321httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling

EPSS

Процентиль: 97%

0.33369

Средний

8.3 High

CVSS3

Связанные уязвимости

CVE-2022-22720

CVSS3: 9.8

ubuntu

почти 4 года назад

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

CVE-2022-22720

CVSS3: 9.8

nvd

почти 4 года назад

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

CVE-2022-22720

CVSS3: 9.8

msrc

почти 4 года назад

HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

CVE-2022-22720

CVSS3: 9.8

debian

почти 4 года назад

Apache HTTP Server 2.4.52 and earlier fails to close inbound connectio ...

RLSA-2022:1049

rocky

почти 4 года назад

Important: httpd:2.4 security update

EPSS

Процентиль: 97%

0.33369

Средний

8.3 High

CVSS3