-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: httpd24-httpd security and bug fix update
Advisory ID:       RHSA-2022:6753-01
Product:           Red Hat Software Collections
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6753
Issue date:        2022-09-29
CVE Names:         CVE-2021-33193 CVE-2021-34798 CVE-2021-36160 
                   CVE-2021-39275 CVE-2021-44224 CVE-2022-22719 
                   CVE-2022-22721 CVE-2022-23943 CVE-2022-26377 
                   CVE-2022-28614 CVE-2022-28615 CVE-2022-29404 
                   CVE-2022-30522 CVE-2022-30556 CVE-2022-31813 
=====================================================================

1. Summary:

An update for httpd24-httpd is now available for Red Hat Software
Collections.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

3. Description:

The httpd packages provide the Apache HTTP Server, a powerful, efficient,
and extensible web server.

Security Fix(es):

* httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)

* httpd: Request splitting via HTTP/2 method injection and mod_proxy
(CVE-2021-33193)

* httpd: NULL pointer dereference via malformed requests (CVE-2021-34798)

* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path
(CVE-2021-36160)

* httpd: Out-of-bounds write in ap_escape_quotes() via malicious input
(CVE-2021-39275)

* httpd: possible NULL dereference or SSRF in forward proxy configurations
(CVE-2021-44224)

* httpd: mod_lua: Use of uninitialized value of in r:parsebody
(CVE-2022-22719)

* httpd: core: Possible buffer overflow with very large or unlimited
LimitXMLRequestBody (CVE-2022-22721)

* httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)

* httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)

* httpd: mod_sed: DoS vulnerability (CVE-2022-30522)

* httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism
(CVE-2022-31813)

* httpd: out-of-bounds read via ap_rwrite() (CVE-2022-28614)

* httpd: out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)

* httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* proxy rewrite to unix socket fails with CVE-2021-40438 fix (BZ#2022319)

Additional changes:

* To fix CVE-2022-29404, the default value for the "LimitRequestBody"
directive in the Apache HTTP Server has been changed from 0 (unlimited) to
1 GiB.

On systems where the value of "LimitRequestBody" is not explicitly
specified in an httpd configuration file, updating the httpd package sets
"LimitRequestBody" to the default value of 1 GiB. As a consequence, if the
total size of the HTTP request body exceeds this 1 GiB default limit, httpd
returns the 413 Request Entity Too Large error code.

If the new default allowed size of an HTTP request message body is
insufficient for your use case, update your httpd configuration files
within the respective context (server, per-directory, per-file, or
per-location) and set your preferred limit in bytes. For example, to set a
new 2 GiB limit, use:

LimitRequestBody 2147483648

Systems already configured to use any explicit value for the
"LimitRequestBody" directive are unaffected by this change.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted
automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1966728 - CVE-2021-33193 httpd: Request splitting via HTTP/2 method injection and mod_proxy
2005119 - CVE-2021-39275 httpd: Out-of-bounds write in ap_escape_quotes() via malicious input
2005124 - CVE-2021-36160 httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path
2005128 - CVE-2021-34798 httpd: NULL pointer dereference via malformed requests
2034672 - CVE-2021-44224 httpd: possible NULL dereference or SSRF in forward proxy configurations
2064319 - CVE-2022-23943 httpd: mod_sed: Read/write beyond bounds
2064320 - CVE-2022-22721 httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
2064322 - CVE-2022-22719 httpd: mod_lua: Use of uninitialized value of in r:parsebody
2094997 - CVE-2022-26377 httpd: mod_proxy_ajp: Possible request smuggling
2095002 - CVE-2022-28614 httpd: out-of-bounds read via ap_rwrite()
2095006 - CVE-2022-28615 httpd: out-of-bounds read in ap_strcmp_match()
2095012 - CVE-2022-29404 httpd: mod_lua: DoS in r:parsebody
2095015 - CVE-2022-30522 httpd: mod_sed: DoS vulnerability
2095018 - CVE-2022-30556 httpd: mod_lua: Information disclosure with websockets
2095020 - CVE-2022-31813 httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source:
httpd24-httpd-2.4.34-23.el7.5.src.rpm

noarch:
httpd24-httpd-manual-2.4.34-23.el7.5.noarch.rpm

ppc64le:
httpd24-httpd-2.4.34-23.el7.5.ppc64le.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.ppc64le.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.ppc64le.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_session-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.ppc64le.rpm

s390x:
httpd24-httpd-2.4.34-23.el7.5.s390x.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.s390x.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.s390x.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_session-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.s390x.rpm

x86_64:
httpd24-httpd-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_session-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source:
httpd24-httpd-2.4.34-23.el7.5.src.rpm

noarch:
httpd24-httpd-manual-2.4.34-23.el7.5.noarch.rpm

x86_64:
httpd24-httpd-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_session-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-33193
https://access.redhat.com/security/cve/CVE-2021-34798
https://access.redhat.com/security/cve/CVE-2021-36160
https://access.redhat.com/security/cve/CVE-2021-39275
https://access.redhat.com/security/cve/CVE-2021-44224
https://access.redhat.com/security/cve/CVE-2022-22719
https://access.redhat.com/security/cve/CVE-2022-22721
https://access.redhat.com/security/cve/CVE-2022-23943
https://access.redhat.com/security/cve/CVE-2022-26377
https://access.redhat.com/security/cve/CVE-2022-28614
https://access.redhat.com/security/cve/CVE-2022-28615
https://access.redhat.com/security/cve/CVE-2022-29404
https://access.redhat.com/security/cve/CVE-2022-30522
https://access.redhat.com/security/cve/CVE-2022-30556
https://access.redhat.com/security/cve/CVE-2022-31813
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/articles/6975397

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYzXoqNzjgjWX9erEAQhSKA//d1V5w3Dbdd0R1QxlXMIweLpztJrkXpmN
EY7WAFIMy0MG64KNjZFF5i4USpUlCm/tZX/fHZas4JjhZBqLxNSqsOdPeynDqp+8
qZnnGiIhyO37S7x5v89VSaWngLpTi2f0d7RmJ05VJzAP8Q0a9cTqtIZiCsM18tTg
BdoD1M/VWUhtPWCzgXiQVI8yF44IOenN2095OCv1Vxc3kiwQdbWcd7Uqz2TgVQ1m
qeqh9AHqaDTwHVM9Ipj5oGp1Ue5zsyAEd77ClBCAzP3p7bWucfTErDrUSE3/hkDm
H8BlPVPaOsRv0poFvvCODQhccC2bFc3uxoKzfSx+/WwkrU7vO/5/npmOfcwKfvBQ
FYqhqADiUcfpJGENligpNAHLI+Pijrl2Tfwl0XbDa8+7KXQ0T75VG3Gq7dFlPcUm
965hFguLI0es2FpGcJldEqsc1XJxdkPmzTYhqDWLLED5X72dwQdtKwhMaFFVctK+
KyspQqaci6bVr9ETF89r0ZBmnxXjSIY7/ijySy0KnldW25t+ZGmLV4pM3CYb7ZVz
qEm9I/oRD0JB/4C5Bk9j5nWF3gzE2MhYfeepqINGIbfvNPiP8G2LFL/CEz46isF9
rFUT/az/p5mdNEwwe5GhEgLkpk0fhcZiAtJ4bGRcJ9YRURh5rrMPtXmXP5THoMau
3VmN11LnfT4=
=pvMD
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce