CVE-2022-22721

Description

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

References

https://support.apple.com/en-us/HT213256

https://support.apple.com/en-us/102770

https://www.oracle.com/security-alerts/cpujul2022.html

https://www.oracle.com/security-alerts/cpuapr2022.html

https://support.apple.com/kb/HT213257

https://support.apple.com/kb/HT213256

https://support.apple.com/kb/HT213255

https://security.netapp.com/advisory/ntap-20220321-0001/

https://security.gentoo.org/glsa/202208-20

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/

https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html

https://httpd.apache.org/security/vulnerabilities_24.html

http://www.openwall.com/lists/oss-security/2022/03/14/2

http://seclists.org/fulldisclosure/2022/May/38

http://seclists.org/fulldisclosure/2022/May/35

http://seclists.org/fulldisclosure/2022/May/33

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3