Vulnerability Description
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | <= 2.4.52 |
| Fedoraproject | Fedora | 34 |
| Debian | Debian Linux | 9.0 |
| Oracle | Enterprise Manager Ops Center | 12.4.0.0 |
| Oracle | Http Server | 12.2.1.3.0 |
| Oracle | Zfs Storage Appliance Kit | 8.8 |
| Apple | Mac Os X | 10.15.7 |
| Apple | Macos | < 10.15.7 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2022/May/33Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/May/35Mailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2022/May/38Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/03/14/3Mailing ListThird Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202208-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220321-0001/Third Party Advisory
- https://support.apple.com/kb/HT213255Third Party Advisory
- https://support.apple.com/kb/HT213256Third Party Advisory
- https://support.apple.com/kb/HT213257Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
FAQ
What is CVE-2022-22720?
CVE-2022-22720 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
How severe is CVE-2022-22720?
CVE-2022-22720 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-22720?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Fedoraproject Fedora, Debian Debian Linux, Oracle Enterprise Manager Ops Center, Oracle Http Server.