The release of the Apache HTTP Server 2.4.53 has been published, featuring 19 changes and fixing 8 vulnerabilities:
- CVE-2022-31813 — a vulnerability in mod_proxy that allows blocking the sending of X-Forwarded-* headers containing the IP address from which the original request was made. This issue can be exploited to bypass IP access restrictions.
- CVE-2022-30556 — a vulnerability in mod_lua that allows access to data outside of the allocated buffer through manipulation of the r:wsread() function in Lua scripts.
- CVE-2022-30522 — denial of service (memory exhaustion) when processing certain data by the mod_sed module.
- CVE-2022-29404 — denial of service in mod_lua, exploited through specially crafted requests sent to Lua handlers using the r:parsebody(0) call.
- CVE-2022-28615, CVE-2022-28614 — denial of service or access to data in the process memory due to errors in ap_strcmp_match() and ap_rwrite() functions, leading to reading outside the buffer boundary.
- CVE-2022-28330 — information leak from areas outside the buffer boundaries in mod_isapi (the issue is only present on the Windows platform).
- CVE-2022-26377 — the mod_proxy_ajp module is vulnerable to HTTP Request Smuggling attacks on frontend-backend systems, allowing injection into the contents of other users' requests processed in the same thread between the frontend and backend.
The most notable changes not related to security:
- In mod_ssl, compatibility of the SSLFIPS mode with OpenSSL 3.0 has been ensured.
- The ab utility now supports TLSv1.3 (requires linking with SSL-a library that supports this protocol).
- In mod_md, the MDCertificateAuthority directive now allows the use of more than one name and URL for the certificate authority. New directives have been added: MDRetryDelay (defines the delay before sending a retry request) and MDRetryFailover (defines the number of retry attempts in case of failure before choosing an alternative certificate authority). Support for the "auto" state has been added when outputting values in the "key: value" format. Management of certificates for users of secured VPNFixed bugs and memory leaks.
- The mod_http2 module has been cleansed of unused and unsafe code.
- In mod_proxy, reflection of the backend network port is provided in error messages logged.
- In mod_heartmonitor, the value of the HeartbeatMaxServers parameter has been changed from 0 to 10 (initializing 10 shared memory slots).
Source: opennet.ru
