CVE-2022-28614
Description
Moderate: httpd security, bug fix, and enhancement update
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2022-8067.html
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2022-7647.html
Vendor advisory: alma — https://bugzilla.redhat.com/2095020
Vendor advisory: alma — https://bugzilla.redhat.com/2095018
Vendor advisory: alma — https://bugzilla.redhat.com/2095015
Vendor advisory: alma — https://bugzilla.redhat.com/2095012
Vendor advisory: alma — https://bugzilla.redhat.com/2095006
Vendor advisory: alma — https://bugzilla.redhat.com/2095002
Vendor advisory: alma — https://bugzilla.redhat.com/2094997
Vendor advisory: alma — https://bugzilla.redhat.com/2064322
Vendor advisory: alma — https://bugzilla.redhat.com/2064320
Vendor advisory: alma — https://bugzilla.redhat.com/2064319
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2022:7647
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2022:8067
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2022-28614.html
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2022:7647
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2022:8067
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2022-28614
Mitigation details
Description httpd: Out-of-bounds read via ap_rwrite() CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Errata / fixed releases ProductPackageAdvisoryReleased JBoss Core Services for RHEL 8jbcs-httpd24-httpd-0:2.4.51-37.el8jbcsRHSA-2022:88402022-12-08T00:00:00Z JBoss Core Services on RHEL 7jbcs-httpd24-httpd-0:2.4.51-37.el7jbcsRHSA-2022:88402022-12-08T00:00:00Z Red Hat Enterprise Linux…
Description
httpd: Out-of-bounds read via ap_rwrite()
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| JBoss Core Services for RHEL 8 | jbcs-httpd24-httpd-0:2.4.51-37.el8jbcs | RHSA-2022:8840 | 2022-12-08T00:00:00Z |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-httpd-0:2.4.51-37.el7jbcs | RHSA-2022:8840 | 2022-12-08T00:00:00Z |
| Red Hat Enterprise Linux 8 | httpd:2.4-8070020220725152258.3b9f49c4 | RHSA-2022:7647 | 2022-11-08T00:00:00Z |
| Red Hat Enterprise Linux 9 | httpd-0:2.4.53-7.el9 | RHSA-2022:8067 | 2022-11-15T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | httpd24-httpd-0:2.4.34-23.el7.5 | RHSA-2022:6753 | 2022-09-29T00:00:00Z |
| Text-Only JBCS | | RHSA-2022:8841 | 2022-12-08T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 6 | httpd | Out of support scope |
| Red Hat Enterprise Linux 7 | httpd | Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | httpd22 | Out of support scope |
| Red Hat JBoss Web Server 3 | httpd24 | Fix deferred |
Apply commands
yum update -y jbcs-httpd24-httpd
# or:
dnf upgrade -y jbcs-httpd24-httpdOS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bullseye | fixed | 2.4.54-1~deb11u1 |
| debian | forky | fixed | 2.4.54-1 |
| debian | sid | fixed | 2.4.54-1 |
| debian | trixie | fixed | 2.4.54-1 |
| debian | bookworm | fixed | 2.4.54-1 |
| rhel | 9 | fixed | |
| arch | fixed | 2.4.54-1 | |
| rocky | 8 | fixed | |
| sles | affected | | |
| rocky | 9 | fixed | |
References
- https://security-tracker.debian.org/tracker/CVE-2022-28614
- https://access.redhat.com/errata/RHSA-2022:8067
- https://errata.rockylinux.org/RLSA-2022:7647
- https://www.suse.com/security/cve/CVE-2022-28614.html
- https://errata.rockylinux.org/RLSA-2022:8067
- https://access.redhat.com/errata/RHSA-2022:7647
- https://bugzilla.redhat.com/2064319
- https://bugzilla.redhat.com/2064320
- https://bugzilla.redhat.com/2064322
- https://bugzilla.redhat.com/2094997
- https://bugzilla.redhat.com/2095002
- https://bugzilla.redhat.com/2095006
- https://bugzilla.redhat.com/2095012
- https://bugzilla.redhat.com/2095015
- https://bugzilla.redhat.com/2095018
- https://bugzilla.redhat.com/2095020
- https://errata.almalinux.org/8/ALSA-2022-7647.html
- https://errata.almalinux.org/9/ALSA-2022-8067.html
Verify integrity in audit chain (admin only). AS-IS.