RHSA-2022:7647
Vulnerability from csaf_opensuse - Published: 2022-11-08 00:00 - Updated: 2026-09-20 11:24Summary
security update for httpd
Severity
Moderate
Notes
Title of the patch: security update for httpd
Description of the patch: This security update provides a functional equivalent of RHSA-2022:7647.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2022:7647.
Patchnames: RHSA-2022:7647
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.9 (Medium)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 | — |
Vendor Fix
|
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
11 products, the same list as for
CVE-2022-22719
Threats
Impact
important
7.4 (High)
Affected products
Recommended
11 products, the same list as for
CVE-2022-22719
Threats
Impact
important
7.4 (High)
Affected products
Recommended
11 products, the same list as for
CVE-2022-22719
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2022-22719
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
11 products, the same list as for
CVE-2022-22719
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2022-22719
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2022-22719
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2022-22719
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2022-22719
Threats
Impact
moderate
References
39 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for httpd",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2022:7647.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2022:7647.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2022:7647",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2022_7647.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-22719 page",
"url": "https://www.suse.com/security/cve/CVE-2022-22719/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-22721 page",
"url": "https://www.suse.com/security/cve/CVE-2022-22721/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-23943 page",
"url": "https://www.suse.com/security/cve/CVE-2022-23943/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-26377 page",
"url": "https://www.suse.com/security/cve/CVE-2022-26377/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-28614 page",
"url": "https://www.suse.com/security/cve/CVE-2022-28614/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-28615 page",
"url": "https://www.suse.com/security/cve/CVE-2022-28615/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-29404 page",
"url": "https://www.suse.com/security/cve/CVE-2022-29404/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-30522 page",
"url": "https://www.suse.com/security/cve/CVE-2022-30522/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-30556 page",
"url": "https://www.suse.com/security/cve/CVE-2022-30556/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-31813 page",
"url": "https://www.suse.com/security/cve/CVE-2022-31813/"
}
],
"title": "security update for httpd",
"tracking": {
"current_release_date": "2026-09-20T11:24:08Z",
"generator": {
"date": "2022-11-08T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2022:7647",
"initial_release_date": "2022-11-08T00:00:00Z",
"revision_history": [
{
"date": "2022-11-08T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T11:24:08Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"product": {
"name": "httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch (httpd:2.4)",
"product_id": "httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd-filesystem@2.4.37-51.module+el8.7.0+16050+02173b8e?arch=noarch\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8"
}
}
},
{
"category": "product_version",
"name": "httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"product": {
"name": "httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch (httpd:2.4)",
"product_id": "httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd-manual@2.4.37-51.module+el8.7.0+16050+02173b8e?arch=noarch\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product": {
"name": "httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64 (httpd:2.4)",
"product_id": "httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd@2.4.37-51.module+el8.7.0+16050+02173b8e?arch=x86_64\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product": {
"name": "httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64 (httpd:2.4)",
"product_id": "httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd-devel@2.4.37-51.module+el8.7.0+16050+02173b8e?arch=x86_64\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product": {
"name": "httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64 (httpd:2.4)",
"product_id": "httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd-tools@2.4.37-51.module+el8.7.0+16050+02173b8e?arch=x86_64\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8"
}
}
},
{
"category": "product_version",
"name": "mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"product": {
"name": "mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64 (httpd:2.4)",
"product_id": "mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_http2@1.15.7-5.module+el8.6.0+13996+01710940?arch=x86_64\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product": {
"name": "mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64 (httpd:2.4)",
"product_id": "mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_ldap@2.4.37-51.module+el8.7.0+16050+02173b8e?arch=x86_64\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8"
}
}
},
{
"category": "product_version",
"name": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"product": {
"name": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64 (httpd:2.4)",
"product_id": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_md@2.0.8-8.module+el8.3.0+6814+67d1e611?arch=x86_64\u0026rpmmod=httpd:2.4:8000020230912110926:rhel8\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product": {
"name": "mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64 (httpd:2.4)",
"product_id": "mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_proxy_html@2.4.37-51.module+el8.7.0+16050+02173b8e?arch=x86_64\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product": {
"name": "mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64 (httpd:2.4)",
"product_id": "mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_session@2.4.37-51.module+el8.7.0+16050+02173b8e?arch=x86_64\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product": {
"name": "mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64 (httpd:2.4)",
"product_id": "mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_ssl@2.4.37-51.module+el8.7.0+16050+02173b8e?arch=x86_64\u0026rpmmod=httpd:2.4:8070020221108161709:rhel8\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 8",
"product": {
"name": "SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:8"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
},
"product_reference": "httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
},
"product_reference": "httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4"
},
"product_reference": "httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4"
},
"product_reference": "httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
},
"product_reference": "httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4"
},
"product_reference": "mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
},
"product_reference": "mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4"
},
"product_reference": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
},
"product_reference": "mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
},
"product_reference": "mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
},
"product_reference": "mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-22719",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-22719"
}
],
"notes": [
{
"category": "general",
"text": "A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-22719",
"url": "https://www.suse.com/security/cve/CVE-2022-22719"
},
{
"category": "external",
"summary": "SUSE Bug 1197091 for CVE-2022-22719",
"url": "https://bugzilla.suse.com/1197091"
},
{
"category": "external",
"summary": "SUSE Bug 1198430 for CVE-2022-22719",
"url": "https://bugzilla.suse.com/1198430"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-22719"
},
{
"cve": "CVE-2022-22721",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-22721"
}
],
"notes": [
{
"category": "general",
"text": "If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-22721",
"url": "https://www.suse.com/security/cve/CVE-2022-22721"
},
{
"category": "external",
"summary": "SUSE Bug 1197096 for CVE-2022-22721",
"url": "https://bugzilla.suse.com/1197096"
},
{
"category": "external",
"summary": "SUSE Bug 1198430 for CVE-2022-22721",
"url": "https://bugzilla.suse.com/1198430"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-22721"
},
{
"cve": "CVE-2022-23943",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-23943"
}
],
"notes": [
{
"category": "general",
"text": "Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-23943",
"url": "https://www.suse.com/security/cve/CVE-2022-23943"
},
{
"category": "external",
"summary": "SUSE Bug 1197098 for CVE-2022-23943",
"url": "https://bugzilla.suse.com/1197098"
},
{
"category": "external",
"summary": "SUSE Bug 1198430 for CVE-2022-23943",
"url": "https://bugzilla.suse.com/1198430"
},
{
"category": "external",
"summary": "SUSE Bug 1200351 for CVE-2022-23943",
"url": "https://bugzilla.suse.com/1200351"
},
{
"category": "external",
"summary": "SUSE Bug 1219585 for CVE-2022-23943",
"url": "https://bugzilla.suse.com/1219585"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-23943"
},
{
"cve": "CVE-2022-26377",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-26377"
}
],
"notes": [
{
"category": "general",
"text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027) vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-26377",
"url": "https://www.suse.com/security/cve/CVE-2022-26377"
},
{
"category": "external",
"summary": "SUSE Bug 1200338 for CVE-2022-26377",
"url": "https://bugzilla.suse.com/1200338"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-26377"
},
{
"cve": "CVE-2022-28614",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-28614"
}
],
"notes": [
{
"category": "general",
"text": "The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the \u0027ap_rputs\u0027 function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-28614",
"url": "https://www.suse.com/security/cve/CVE-2022-28614"
},
{
"category": "external",
"summary": "SUSE Bug 1200340 for CVE-2022-28614",
"url": "https://bugzilla.suse.com/1200340"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-28614"
},
{
"cve": "CVE-2022-28615",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-28615"
}
],
"notes": [
{
"category": "general",
"text": "Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-28615",
"url": "https://www.suse.com/security/cve/CVE-2022-28615"
},
{
"category": "external",
"summary": "SUSE Bug 1200341 for CVE-2022-28615",
"url": "https://bugzilla.suse.com/1200341"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-28615"
},
{
"cve": "CVE-2022-29404",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-29404"
}
],
"notes": [
{
"category": "general",
"text": "In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-29404",
"url": "https://www.suse.com/security/cve/CVE-2022-29404"
},
{
"category": "external",
"summary": "SUSE Bug 1200345 for CVE-2022-29404",
"url": "https://bugzilla.suse.com/1200345"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-29404"
},
{
"cve": "CVE-2022-30522",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-30522"
}
],
"notes": [
{
"category": "general",
"text": "If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-30522",
"url": "https://www.suse.com/security/cve/CVE-2022-30522"
},
{
"category": "external",
"summary": "SUSE Bug 1200352 for CVE-2022-30522",
"url": "https://bugzilla.suse.com/1200352"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-30522"
},
{
"cve": "CVE-2022-30556",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-30556"
}
],
"notes": [
{
"category": "general",
"text": "Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-30556",
"url": "https://www.suse.com/security/cve/CVE-2022-30556"
},
{
"category": "external",
"summary": "SUSE Bug 1200350 for CVE-2022-30556",
"url": "https://bugzilla.suse.com/1200350"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-30556"
},
{
"cve": "CVE-2022-31813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-31813"
}
],
"notes": [
{
"category": "general",
"text": "Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-31813",
"url": "https://www.suse.com/security/cve/CVE-2022-31813"
},
{
"category": "external",
"summary": "SUSE Bug 1200348 for CVE-2022-31813",
"url": "https://bugzilla.suse.com/1200348"
},
{
"category": "external",
"summary": "SUSE Bug 1219585 for CVE-2022-31813",
"url": "https://bugzilla.suse.com/1219585"
},
{
"category": "external",
"summary": "SUSE Bug 1225670 for CVE-2022-31813",
"url": "https://bugzilla.suse.com/1225670"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-51.module+el8.7.0+16050+02173b8e.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-5.module+el8.6.0+13996+01710940.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-51.module+el8.7.0+16050+02173b8e.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2022-11-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-31813"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…