CVE-2022-28615 — Read beyond bounds in ap_strcmp_match()

描述

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.

如何修補 CVE-2022-28615

要修補 CVE-2022-28615,請將受影響套件升級到下列已修補版本。

—升級至 2.4.54-r0 或更新版本
—升級至 2.4.54 或更新版本
—升級至 2.4.54-1~deb11u1 或更新版本

CVE-2022-28615 正在被利用嗎?

中等 — EPSS 為 5.7%,可持續追蹤但非最高優先。

受影響套件(3)

from 0, < 2.4.54-r0
from 0, < 2.4.54
from 0, < 2.4.54-1~deb11u1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

參考連結(9)

ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-28615
ADVISORYsecurity.alpinelinux.org/vuln/CVE-2022-28615
WEBwww.openwall.com/lists/oss-security/2022/06/08/9
WEBhttpd.apache.org/security/vulnerabilities_24.html