HTTP Request Smuggling Affecting mod_ldap package, versions <0:2.4.6-97.el7_9.5


Severity

Recommended
0.0
high
0
10

Based on CentOS security rating.

Threat Intelligence

EPSS
1.04% (85th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS7-MODLDAP-2427113
  • published16 Mar 2022
  • disclosed14 Mar 2022

Introduced: 14 Mar 2022

CVE-2022-22720  (opens in a new tab)
CWE-444  (opens in a new tab)

How to fix?

Upgrade Centos:7 mod_ldap to version 0:2.4.6-97.el7_9.5 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mod_ldap package and not the mod_ldap package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

References

CVSS Scores

version 3.1