QID 240698

The httpd packages provide the apache http server, a powerful, efficient, and extensible web server...Security Fix(es):

httpd: mod_sed: read/write beyond bounds (cve-2022-23943).
Httpd: request splitting via http/2 method injection and mod_proxy (cve-2021-33193).
Httpd: null pointer dereference via malformed requests (cve-2021-34798).
Httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (cve-2021-36160).
Httpd: out-of-bounds write in ap_escape_quotes() via malicious input (cve-2021-39275).
Httpd: possible null dereference or ssrf in forward proxy configurations (cve-2021-44224).
Httpd: mod_lua: use of uninitialized value of in r:parsebody (cve-2022-22719).
Httpd: core: possible buffer overflow with very large or unlimited limitxmlrequestbody (cve-2022-22721).
Httpd: mod_proxy_ajp: possible request smuggling (cve-2022-26377).
Httpd: mod_lua: dos in r:parsebody (cve-2022-29404).
Httpd: mod_sed: dos vulnerability (cve-2022-30522).
Httpd: mod_proxy: x-forwarded-for dropped by hop-by-hop mechanism (cve-2022-31813).
Httpd: out-of-bounds read via ap_rwrite() (cve-2022-28614).
Httpd: out-of-bounds read in ap_strcmp_match() (cve-2022-28615).
Httpd: mod_lua: information disclosure with websockets (cve-2022-30556).

Red Hat software collections (for rhel server) 1 for rhel 7 x86_64.
Red hat software collections (for rhel server for system z) 1 for rhel 7 s390x.
Red hat software collections (for rhel server for ibm power le) 1 for rhel 7 ppc64le.
Red hat software collections (for rhel workstation) 1 for rhel 7 x86_64.

Successful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.