The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5333-1 advisory.

    Chamal De Silva discovered that the Apache HTTP Server mod_lua module incorrectly handled certain crafted     request bodies. A remote attacker could possibly use this issue to cause the server to crash, resulting in     a denial of service. (CVE-2022-22719)

    James Kettle discovered that the Apache HTTP Server incorrectly closed inbound connection when certain     errors are encountered. A remote attacker could possibly use this issue to perform an HTTP Request     Smuggling attack. (CVE-2022-22720)

    It was discovered that the Apache HTTP Server incorrectly handled large LimitXMLRequestBody settings on     certain platforms. In certain configurations, a remote attacker could use this issue to cause the server     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22721)

    Ronald Crane discovered that the Apache HTTP Server mod_sed module incorrectly handled memory. A remote     attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2022-23943)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS / 20.04 LTS : Apache HTTP Server vulnerabilities (USN-5333-1)

critical Nessus Plugin ID 159024

Version 1.8