The release of the Apache HTTP server 2.4.53 has been published, featuring 14 changes and fixing 4 vulnerabilities:
- CVE-2022-22720 — the possibility of an 'HTTP Request Smuggling' attack, allowing intrusions into the content of other users' requests transmitted via mod_proxy by sending specially crafted client requests (for example, it can lead to the injection of malicious JavaScript code into another user’s session on the site). The issue is caused by leaving incoming connections open after errors occur while processing malformed request bodies.
- CVE-2022-23943 — a buffer overflow in the mod_sed module, allowing the attacker to overwrite heap memory with controlled data.
- CVE-2022-22721 — the possibility of buffer out-of-bounds write due to integer overflow occurring when transmitting request bodies larger than 350MB. The issue manifests on 32-bit systems with settings where the LimitXMLRequestBody value is set too high (default is 1MB; for the attack, the limit must be higher than 350MB).
- CVE-2022-22719 — a vulnerability in mod_lua, allowing the reading of random memory areas and crashing the process when processing specially crafted request bodies. The issue is caused by using uninitialized values in the r:parsebody function code.
The most notable changes not related to security:
- In mod_proxy, the limit on the number of characters in the handler (worker) name has been increased. Selective timeout settings for backend and frontend have been added (for example, tied to the worker). For requests transmitted via websockets or the CONNECT method, the timeout is now set to the maximum value specified for the backend and frontend.
- The processing of opening DBM files and loading the DBM driver has been separated. In case of failure, the log now displays more detailed information about the error and the driver.
- In mod_md, processing requests to \/.well-known\/acme-challenge\/ has been stopped unless in settings domain the use of the 'http-01' validation type is explicitly enabled.
- In mod_dav, a regression issue that led to high memory consumption when processing a large number of resources has been eliminated.
- Support for using the pcre2 (10.x) library instead of pcre (8.x) for regular expression processing has been added.
- Support for anomaly analysis of the LDAP protocol has been added to the request filters to ensure proper data escaping when attempting LDAP injection attacks.
- Mutual blocking in mpm_event, which occurred during restarts or when exceeding the MaxConnectionsPerChild limit on high-load systems, has been resolved.
Source: opennet.ru
