Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-28615
HistoryJun 09, 2022 - 12:00 a.m.

CVE-2022-28615

2022-06-0900:00:00
ubuntu.com
ubuntu.com
29
apache http server
version 2.4.53
vulnerability
disclosure
ap_strcmp_match()
third-party modules
lua scripts
debian
bugs
unix

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

0.015

Percentile

86.8%

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due
to a read beyond bounds in ap_strcmp_match() when provided with an
extremely large input buffer. While no code distributed with the server can
be coerced into such a call, third-party modules or lua scripts that use
ap_strcmp_match() may hypothetically be affected.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchapache2< 2.4.29-1ubuntu4.24UNKNOWN
ubuntu20.04noarchapache2< 2.4.41-4ubuntu3.12UNKNOWN
ubuntu21.10noarchapache2< 2.4.48-3.1ubuntu3.5UNKNOWN
ubuntu22.04noarchapache2< 2.4.52-1ubuntu4.1UNKNOWN
ubuntu22.10noarchapache2< 2.4.54-2ubuntu1UNKNOWN
ubuntu14.04noarchapache2< 2.4.7-1ubuntu4.22+esm6UNKNOWN
ubuntu16.04noarchapache2< 2.4.18-2ubuntu3.17+esm6UNKNOWN

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

0.015

Percentile

86.8%