CVE-2022-2255
Summary
| CVE | CVE-2022-2255 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-08-25 18:15:00 UTC |
|---|
| Updated | 2022-10-01 02:31:00 UTC |
|---|
| Description | A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Version 4.9.3 — mod_wsgi 4.9.3 documentation |
MISC |
modwsgi.readthedocs.io |
|
| mod_wsgi/mod_wsgi.c at 4.9.2 · GrahamDumpleton/mod_wsgi · GitHub |
MISC |
github.com |
|
| [SECURITY] [DLA 3111-1] mod-wsgi security update |
MLIST |
lists.debian.org |
|
| mod_wsgi/mod_wsgi.c at 4.9.2 · GrahamDumpleton/mod_wsgi · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181096 Debian Security Update for mod-wsgi (DLA 3111-1)
- 181418 Debian Security Update for mod-wsgi (CVE-2022-2255)
- 198883 Ubuntu Security Notification for mod-wsgi Vulnerability (USN-5551-1)
- 356288 Amazon Linux Security Advisory for mod_wsgi : ALASHTTPD_MODULES-2023-001
- 672581 EulerOS Security Update for mod-wsgi (EulerOS-SA-2023-1328)
- 752870 SUSE Enterprise Linux Security Update for apache2-mod_wsgi (SUSE-SU-2022:4010-1)
- 753012 SUSE Enterprise Linux Security Update for apache2-mod_wsgi (SUSE-SU-2022:4488-1)
- 903831 Common Base Linux Mariner (CBL-Mariner) Security Update for mod_wsgi (10734)
- 904422 Common Base Linux Mariner (CBL-Mariner) Security Update for mod_wsgi (10734-1)
