Security Bulletin: Vulnerability in Apache HTTP (CVE-2022-22720) affects Power HMC

Summary

Apache HTTP webserver is used by IBM Power Hardware Management Console (HMC) for accepting https request and transfer to and fro to internal applications. This bulletin provides a remediation for the impacted vulnerability, CVE-2022-22720 by upgrading IBM Power Hardware Management Console (HMC) respective PTF and thus addressing the exposure to the vulnerability.

Vulnerability Details

CVEID:CVE-2022-22720
**DESCRIPTION:**Apache HTTP Server is vulnerable to HTTP request smuggling, caused by the failure to close inbound connection when errors are encountered discarding the request body. An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221668 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

The following fixes are available on IBM Fix Central at: <http://www-933.ibm.com/support/fixcentral/&gt;

Product

|

VRMF

|

APAR

|

Remediation/Fix

—|—|—|—

Power HMC

|

V9.2.952.0 ppc

|

MB04331

|

MH01925

Power HMC

|

V9.2.952.0 x86

|

MB04330

|

MH01924

Power HMC

|

V10.1.1010.0 ppc

|

MB04335

|

MF69724

Power HMC

|

V10.1.1010.0 x86

|

MB04334

|

MF69722

Workarounds and Mitigations

None