CVE-2022-30522

Name
CVE-2022-30522
Description
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://httpd.apache.org/security/vulnerabilities_24.html
MLIST http://www.openwall.com/lists/oss-security/2022/06/08/6
Third Party Advisory https://security.netapp.com/advisory/ntap-20220624-0005/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
Third Party Advisory https://security.gentoo.org/glsa/202208-20
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* http_server >= None <= 2.4.53

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
apache2 edge-main 2.4.54-r0 Kaarle Ritvanen <kunkku@alpinelinux.org> fixed
apache2 3.22-main 2.4.54-r0 None fixed
apache2 3.21-main 2.4.54-r0 None fixed
apache2 3.20-main 2.4.54-r0 None fixed
apache2 3.19-main 2.4.54-r0 None fixed
apache2 3.18-main 2.4.54-r0 None fixed
apache2 3.17-main 2.4.54-r0 None fixed