Vulnerability Description
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.4.0, < 2.4.53 |
| Fedoraproject | Fedora | 34 |
| Debian | Debian Linux | 9.0 |
| Oracle | Http Server | 12.2.1.3.0 |
| Oracle | Zfs Storage Appliance Kit | 8.8 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/03/14/1Mailing ListThird Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://security.gentoo.org/glsa/202208-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220321-0001/Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.tenable.com/security/tns-2022-08Third Party Advisory
- https://www.tenable.com/security/tns-2022-09Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/03/14/1Mailing ListThird Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
FAQ
What is CVE-2022-23943?
CVE-2022-23943 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2...
How severe is CVE-2022-23943?
CVE-2022-23943 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-23943?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Fedoraproject Fedora, Debian Debian Linux, Oracle Http Server, Oracle Zfs Storage Appliance Kit.