<p>Upgrade <code>Ubuntu:22.10</code> <code>apache2</code> to version 2.4.54-2ubuntu1 or higher.</p>

Integer Overflow or Wraparound Affecting apache2 package, versions <2.4.54-2ubuntu1

Threat Intelligence

0.34% (73^rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-UBUNTU2210-APACHE2-3067687
published 10 Jun 2022
disclosed 9 Jun 2022

Report a new vulnerability Found a mistake?

Introduced: 9 Jun 2022

CVE-2022-28614 Open this link in a new tab CWE-190 Open this link in a new tab

How to fix?

Upgrade Ubuntu:22.10 apache2 to version 2.4.54-2ubuntu1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache2 package and not the apache2 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.10 relevant fixed versions and status.

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

Low
Integrity (I)

None
Availability (A)

None

Integer Overflow or Wraparound Affecting apache2 package, versions <2.4.54-2ubuntu1

Severity

Based on Ubuntu security rating