CVE-2022-22720
Summary
| CVE | CVE-2022-22720 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-03-14 11:15:00 UTC |
| Updated | 2023-11-07 03:43:00 UTC |
| Description | Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling |
Risk And Classification
Problem Types: CWE-444
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Http Server | All | All | All | All |
| Operating System | Apple | Macos | All | All | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2020-001 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2021-001 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2021-002 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2021-003 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2021-004 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2021-005 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2021-006 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2021-007 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2021-008 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2022-001 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2022-002 | All | All |
| Operating System | Apple | Macos | 10.15.7 | security_update_2022-003 | All | All |
| Operating System | Apple | Macos | All | All | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2020-001 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2021-001 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2021-002 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2021-003 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2021-004 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2021-005 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2021-006 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2021-007 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2021-008 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2022-001 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2022-002 | All | All |
| Operating System | Apple | Mac Os X | 10.15.7 | security_update_2022-003 | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 34 | All | All | All |
| Operating System | Fedoraproject | Fedora | 35 | All | All | All |
| Operating System | Fedoraproject | Fedora | 36 | All | All | All |
| Application | Oracle | Enterprise Manager Ops Center | 12.4.0.0 | All | All | All |
| Application | Oracle | Http Server | 12.2.1.3.0 | All | All | All |
| Application | Oracle | Http Server | 12.2.1.4.0 | All | All | All |
| Application | Oracle | Zfs Storage Appliance Kit | 8.8 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Apache HTTPD: Multiple Vulnerabilities (GLSA 202208-20) — Gentoo security | GENTOO | security.gentoo.org | |
| [SECURITY] Fedora 36 Update: httpd-2.4.53-1.fc36 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| About the security content of macOS Big Sur 11.6.6 - Apple Support | CONFIRM | support.apple.com | |
| Full Disclosure: APPLE-SA-2022-05-16-2 macOS Monterey 12.4 | FULLDISC | seclists.org | |
| About the security content of macOS Monterey 12.4 - Apple Support | CONFIRM | support.apple.com | |
| Oracle Critical Patch Update Advisory - April 2022 | MISC | www.oracle.com | |
| [SECURITY] [DLA 2960-1] apache2 security update | MLIST | lists.debian.org | |
| [SECURITY] Fedora 34 Update: httpd-2.4.53-1.fc34 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| oss-security - CVE-2022-22720: HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier | MLIST | www.openwall.com | |
| About the security content of Security Update 2022-004 Catalina - Apple Support | CONFIRM | support.apple.com | |
| [SECURITY] Fedora 35 Update: httpd-2.4.53-1.fc35 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| March 2022 Apache HTTP Server Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project | MISC | httpd.apache.org | |
| [SECURITY] Fedora 36 Update: httpd-2.4.53-1.fc36 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| Full Disclosure: APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6 | FULLDISC | seclists.org | |
| [SECURITY] Fedora 34 Update: httpd-2.4.53-1.fc34 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| Full Disclosure: APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina | FULLDISC | seclists.org | |
| Oracle Critical Patch Update Advisory - July 2022 | N/A | www.oracle.com | |
| [SECURITY] Fedora 35 Update: httpd-2.4.53-1.fc35 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: James Kettle <james.kettle portswigger.net>
Legacy QID Mappings
- 150515 Apache HTTP Server 2.4.53 Multiple Vulnerabilities
- 159731 Oracle Enterprise Linux Security Update for httpd (ELSA-2022-1045)
- 159732 Oracle Enterprise Linux Security Update for httpd:2.4 (ELSA-2022-1049)
- 159739 Oracle Enterprise Linux Security Update for httpd (ELSA-2022-9257)
- 179151 Debian Security Update for apache2 (DLA 2960-1)
- 179202 Debian Security Update for apache2 (CVE-2022-22720)
- 198705 Ubuntu Security Notification for Apache Hypertext Transfer Protocol (HTTP) Server Vulnerabilities (USN-5333-1)
- 240168 Red Hat Update for httpd:2.4 (RHSA-2022:1049)
- 240169 Red Hat Update for httpd (RHSA-2022:1045)
- 240190 Red Hat Update for httpd:2.4 (RHSA-2022:1072)
- 240191 Red Hat Update for httpd24-httpd (RHSA-2022:1075)
- 240193 Red Hat Update for httpd:2.4 (RHSA-2022:1102)
- 240235 Red Hat Update for JBoss Core Services (RHSA-2022:1389)
- 240445 Red Hat Update for httpd:2.4 (RHSA-2022:1080)
- 257162 CentOS Security Update for httpd (CESA-2022:1045)
- 282500 Fedora Security Update for httpd (FEDORA-2022-b4103753e9)
- 282521 Fedora Security Update for httpd (FEDORA-2022-21264ec6db)
- 296057 Oracle Solaris 11.4 Support Repository Update (SRU) 44.113.4 Missing (bulletinapr2022)
- 353269 Amazon Linux Security Advisory for httpd : ALAS2-2022-1783
- 353274 Amazon Linux Security Advisory for httpd24 : ALAS-2022-1584
- 354481 Amazon Linux Security Advisory for httpd : ALAS2022-2022-053
- 354482 Amazon Linux Security Advisory for httpd : ALAS2022-2022-202
- 354577 Amazon Linux Security Advisory for httpd : ALAS2022-2022-202
- 355264 Amazon Linux Security Advisory for httpd : ALAS2023-2023-072
- 376607 Apple macOS Security Update 2022-004 Catalina (HT213255)
- 376608 Apple MacOS Big Sur 11.6.6 Not Installed (HT213256)
- 376612 Apple macOS Monterey 12.4 Not Installed (HT213257)
- 376658 F5 BIG-IP Application Security Manager (ASM), Local Traffic Manager (LTM), Access Policy Manager (APM) Apache Hypertext Transfer Protocol Server (HTTP Server) Vulnerability (K67090077)
- 376865 IBM Hypertext Transfer Protocol (HTTP) Server Multiple Vulnerabilities (6565413)
- 377145 Alibaba Cloud Linux Security Update for httpd:2.4 (ALINUX3-SA-2022:0023)
- 377193 Alibaba Cloud Linux Security Update for httpd (ALINUX2-SA-2022:0018)
- 378363 IBM Hypertext Transfer Protocol (HTTP) Server Multiple Vulnerabilities (6565413)
- 378433 Oracle Hypertext Transfer Protocol Server (HTTP Server) Server Multiple Vulnerabilities (CPUAPR2023)
- 500026 Alpine Linux Security Update for apache2
- 503717 Alpine Linux Security Update for apache2
- 590870 Mitsubishi Electric MELSOFT iQ AppPortal Multiple Vulnerabilities (ICSA-22-132-02)
- 671578 EulerOS Security Update for httpd (EulerOS-SA-2022-1569)
- 671659 EulerOS Security Update for httpd (EulerOS-SA-2022-1730)
- 671739 EulerOS Security Update for httpd (EulerOS-SA-2022-1790)
- 671758 EulerOS Security Update for httpd (EulerOS-SA-2022-1807)
- 671800 EulerOS Security Update for httpd (EulerOS-SA-2022-1843)
- 671812 EulerOS Security Update for httpd (EulerOS-SA-2022-1867)
- 671851 EulerOS Security Update for httpd (EulerOS-SA-2022-1893)
- 690812 Free Berkeley Software Distribution (FreeBSD) Security Update for apache httpd (6601c08d-a46c-11ec-8be6-d4c9ef517024)
- 710595 Gentoo Linux Apache HTTPD Multiple Vulnerabilities (GLSA 202208-20)
- 730403 Apache Hypertext Transfer Protocol (HTTP) Server Out-of-bounds Write Vulnerability
- 751909 SUSE Enterprise Linux Security Update for apache2 (SUSE-SU-2022:0928-1)
- 751912 SUSE Enterprise Linux Security Update for apache2 (SUSE-SU-2022:0918-1)
- 751918 SUSE Enterprise Linux Security Update for apache2 (SUSE-SU-2022:0929-1)
- 751936 SUSE Enterprise Linux Security Update for apache2 (SUSE-SU-2022:1031-1)
- 751942 OpenSUSE Security Update for apache2 (openSUSE-SU-2022:1031-1)
- 753400 SUSE Enterprise Linux Security Update for apache2 (SUSE-SU-2022:14924-1)
- 900755 Common Base Linux Mariner (CBL-Mariner) Security Update for httpd (9006)
- 901805 Common Base Linux Mariner (CBL-Mariner) Security Update for httpd (9016-1)
- 940474 AlmaLinux Security Update for httpd:2.4 (ALSA-2022:1049)
- 960324 Rocky Linux Security Update for httpd:2.4 (RLSA-2022:1049)