A httpd24-httpd security and bug fix update has been released for Red Hat Enterprise Linux 7.

RHSA-2022:6753-01: Moderate: httpd24-httpd security and bug fix update

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: httpd24-httpd security and bug fix update
Advisory ID: RHSA-2022:6753-01
Product: Red Hat Software Collections
Advisory URL:   https://access.redhat.com/errata/RHSA-2022:6753
Issue date: 2022-09-29
CVE Names: CVE-2021-33193 CVE-2021-34798 CVE-2021-36160
CVE-2021-39275 CVE-2021-44224 CVE-2022-22719
CVE-2022-22721 CVE-2022-23943 CVE-2022-26377
CVE-2022-28614 CVE-2022-28615 CVE-2022-29404
CVE-2022-30522 CVE-2022-30556 CVE-2022-31813
=====================================================================

1. Summary:

An update for httpd24-httpd is now available for Red Hat Software
Collections.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

3. Description:

The httpd packages provide the Apache HTTP Server, a powerful, efficient,
and extensible web server.

Security Fix(es):

* httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)

* httpd: Request splitting via HTTP/2 method injection and mod_proxy
(CVE-2021-33193)

* httpd: NULL pointer dereference via malformed requests (CVE-2021-34798)

* httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path
(CVE-2021-36160)

* httpd: Out-of-bounds write in ap_escape_quotes() via malicious input
(CVE-2021-39275)

* httpd: possible NULL dereference or SSRF in forward proxy configurations
(CVE-2021-44224)

* httpd: mod_lua: Use of uninitialized value of in r:parsebody
(CVE-2022-22719)

* httpd: core: Possible buffer overflow with very large or unlimited
LimitXMLRequestBody (CVE-2022-22721)

* httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)

* httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)

* httpd: mod_sed: DoS vulnerability (CVE-2022-30522)

* httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism
(CVE-2022-31813)

* httpd: out-of-bounds read via ap_rwrite() (CVE-2022-28614)

* httpd: out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)

* httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* proxy rewrite to unix socket fails with CVE-2021-40438 fix (BZ#2022319)

Additional changes:

* To fix CVE-2022-29404, the default value for the "LimitRequestBody"
directive in the Apache HTTP Server has been changed from 0 (unlimited) to
1 GiB.

On systems where the value of "LimitRequestBody" is not explicitly
specified in an httpd configuration file, updating the httpd package sets
"LimitRequestBody" to the default value of 1 GiB. As a consequence, if the
total size of the HTTP request body exceeds this 1 GiB default limit, httpd
returns the 413 Request Entity Too Large error code.

If the new default allowed size of an HTTP request message body is
insufficient for your use case, update your httpd configuration files
within the respective context (server, per-directory, per-file, or
per-location) and set your preferred limit in bytes. For example, to set a
new 2 GiB limit, use:

LimitRequestBody 2147483648

Systems already configured to use any explicit value for the
"LimitRequestBody" directive are unaffected by this change.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

  https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted
automatically.

5. Bugs fixed (  https://bugzilla.redhat.com/):

1966728 - CVE-2021-33193 httpd: Request splitting via HTTP/2 method injection and mod_proxy
2005119 - CVE-2021-39275 httpd: Out-of-bounds write in ap_escape_quotes() via malicious input
2005124 - CVE-2021-36160 httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path
2005128 - CVE-2021-34798 httpd: NULL pointer dereference via malformed requests
2034672 - CVE-2021-44224 httpd: possible NULL dereference or SSRF in forward proxy configurations
2064319 - CVE-2022-23943 httpd: mod_sed: Read/write beyond bounds
2064320 - CVE-2022-22721 httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
2064322 - CVE-2022-22719 httpd: mod_lua: Use of uninitialized value of in r:parsebody
2094997 - CVE-2022-26377 httpd: mod_proxy_ajp: Possible request smuggling
2095002 - CVE-2022-28614 httpd: out-of-bounds read via ap_rwrite()
2095006 - CVE-2022-28615 httpd: out-of-bounds read in ap_strcmp_match()
2095012 - CVE-2022-29404 httpd: mod_lua: DoS in r:parsebody
2095015 - CVE-2022-30522 httpd: mod_sed: DoS vulnerability
2095018 - CVE-2022-30556 httpd: mod_lua: Information disclosure with websockets
2095020 - CVE-2022-31813 httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source:
httpd24-httpd-2.4.34-23.el7.5.src.rpm

noarch:
httpd24-httpd-manual-2.4.34-23.el7.5.noarch.rpm

ppc64le:
httpd24-httpd-2.4.34-23.el7.5.ppc64le.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.ppc64le.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.ppc64le.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_session-2.4.34-23.el7.5.ppc64le.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.ppc64le.rpm

s390x:
httpd24-httpd-2.4.34-23.el7.5.s390x.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.s390x.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.s390x.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_session-2.4.34-23.el7.5.s390x.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.s390x.rpm

x86_64:
httpd24-httpd-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_session-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source:
httpd24-httpd-2.4.34-23.el7.5.src.rpm

noarch:
httpd24-httpd-manual-2.4.34-23.el7.5.noarch.rpm

x86_64:
httpd24-httpd-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-debuginfo-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-devel-2.4.34-23.el7.5.x86_64.rpm
httpd24-httpd-tools-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ldap-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_proxy_html-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_session-2.4.34-23.el7.5.x86_64.rpm
httpd24-mod_ssl-2.4.34-23.el7.5.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
  https://access.redhat.com/security/team/key/

7. References:

  https://access.redhat.com/security/cve/CVE-2021-33193
  https://access.redhat.com/security/cve/CVE-2021-34798
  https://access.redhat.com/security/cve/CVE-2021-36160
  https://access.redhat.com/security/cve/CVE-2021-39275
  https://access.redhat.com/security/cve/CVE-2021-44224
  https://access.redhat.com/security/cve/CVE-2022-22719
  https://access.redhat.com/security/cve/CVE-2022-22721
  https://access.redhat.com/security/cve/CVE-2022-23943
  https://access.redhat.com/security/cve/CVE-2022-26377
  https://access.redhat.com/security/cve/CVE-2022-28614
  https://access.redhat.com/security/cve/CVE-2022-28615
  https://access.redhat.com/security/cve/CVE-2022-29404
  https://access.redhat.com/security/cve/CVE-2022-30522
  https://access.redhat.com/security/cve/CVE-2022-30556
  https://access.redhat.com/security/cve/CVE-2022-31813
  https://access.redhat.com/security/updates/classification/#moderate
  https://access.redhat.com/articles/6975397

8. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.