RHSA-2022:0143: Important: httpd security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.<br>Security Fix(es):<br><li> httpd: mod_lua: Possible buffer overflow when parsing multipart content (CVE-2021-44790)</li> <li> httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691)</li> <li> httpd: NULL pointer dereference via malformed requests (CVE-2021-34798)</li> <li> httpd: Out-of-bounds write in ap_escape_quotes() via malicious input (CVE-2021-39275)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:0143?
The vulnerability RHSA-2022:0143 is classified as having a high severity due to its potential for exploitation through buffer overflows.
How do I fix RHSA-2022:0143?
To remediate RHSA-2022:0143, update to the recommended Apache HTTP Server version 2.4.6-97.el7_9.4 or later.
Which software is affected by RHSA-2022:0143?
RHSA-2022:0143 affects multiple packages including httpd, httpd-debuginfo, httpd-devel, and httpd-tools across various architectures.
What vulnerabilities are addressed in RHSA-2022:0143?
RHSA-2022:0143 addresses vulnerabilities including a buffer overflow in mod_lua and a heap overflow in mod_session.
Is it safe to use an older version of HTTPD with RHSA-2022:0143?
Using an older version of HTTPD that is impacted by RHSA-2022:0143 poses security risks and is not recommended.