The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7647 advisory.

    - Resolves: #2097015 - CVE-2022-28614 httpd:2.4/httpd: out-of-bounds read via       ap_rwrite()
    - Resolves: #2097031 - CVE-2022-28615 httpd:2.4/httpd: out-of-bounds read in       ap_strcmp_match()
    - Resolves: #2097458 - CVE-2022-30522 httpd:2.4/httpd: mod_sed: DoS       vulnerability
    - Resolves: #2097480 - CVE-2022-30556 httpd:2.4/httpd: mod_lua: Information       disclosure with websockets
    - Resolves: #2098247 - CVE-2022-31813 httpd:2.4/httpd: mod_proxy:
      X-Forwarded-For dropped by hop-by-hop mechanism
    - Resolves: #2097451 - CVE-2022-29404 httpd:2.4/httpd: mod_lua: DoS in       r:parsebody
    - Resolves: #2096997 - CVE-2022-26377 httpd:2.4/httpd: mod_proxy_ajp: Possible       request smuggling
    - Resolves: #2065237 - CVE-2022-22719 httpd:2.4/httpd: mod_lua: Use of       uninitialized value of in r:parsebody
    - Resolves: #2065267 - CVE-2022-22721 httpd:2.4/httpd: core: Possible buffer       overflow with very large or unlimited LimitXMLRequestBody
    - Resolves: #2065324 - CVE-2022-23943 httpd:2.4/httpd: mod_sed: Read/write       beyond bounds
    - Resolves: #2090848 - CVE-2020-13950 httpd:2.4/httpd: mod_proxy NULL pointer       dereference
    - Resolves: #2065249 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling       vulnerability in Apache HTTP Server 2.4.52 and earlier

    mod_http2
    - Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference       or SSRF in forward proxy configurations

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : httpd:2.4 (ELSA-2022-7647)

critical Nessus Plugin ID 167529

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.6 Nov 2, 2024, 2:28 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202411020228
Version 1.5 Oct 23, 2024, 10:51 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202410232251
Version 1.4 Oct 22, 2024, 9:14 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202410222114
Version 1.3 Oct 3, 2023, 2:18 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202310031418
Version 1.2 Nov 16, 2022, 12:10 PM New Plugin Feed: 202211161210