Vulnerability Description
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | <= 2.4.52 |
| Fedoraproject | Fedora | 34 |
| Debian | Debian Linux | 9.0 |
| Oracle | Enterprise Manager Ops Center | 12.4.0.0 |
| Oracle | Http Server | 12.2.1.3.0 |
| Oracle | Zfs Storage Appliance Kit | 8.8 |
| Apple | Mac Os X | >= 10.15, < 10.15.7 |
| Apple | Macos | >= 11.0, < 11.6.6 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2022/May/33Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/35Third Party Advisory
- http://seclists.org/fulldisclosure/2022/May/38Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/03/14/2Mailing ListThird Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202208-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220321-0001/Third Party Advisory
- https://support.apple.com/kb/HT213255Third Party Advisory
- https://support.apple.com/kb/HT213256Third Party Advisory
- https://support.apple.com/kb/HT213257Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
FAQ
What is CVE-2022-22721?
CVE-2022-22721 is a vulnerability with a CVSS score of 9.1 (CRITICAL). If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apach...
How severe is CVE-2022-22721?
CVE-2022-22721 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-22721?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Fedoraproject Fedora, Debian Debian Linux, Oracle Enterprise Manager Ops Center, Oracle Http Server.