rpm package
suse/apache2&distro=SUSE Linux Enterprise Server 11 SP4-LTSS
pkg:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-22721 | — | < 2.2.34-70.41.1 | 2.2.34-70.41.1 | Mar 14, 2022 | If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier. | ||
| CVE-2022-22720 | — | < 2.2.34-70.41.1 | 2.2.34-70.41.1 | Mar 14, 2022 | Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling | ||
| CVE-2021-39275 | — | < 2.2.34-70.38.1 | 2.2.34-70.38.1 | Sep 16, 2021 | ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier. | ||
| CVE-2021-30641 | — | < 2.2.34-70.35.1 | 2.2.34-70.35.1 | Jun 10, 2021 | Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' | ||
| CVE-2020-35452 | — | < 2.2.34-70.35.1 | 2.2.34-70.35.1 | Jun 10, 2021 | Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation | ||
| CVE-2020-1934 | — | < 2.2.34-70.27.1 | 2.2.34-70.27.1 | Apr 1, 2020 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. | ||
| CVE-2020-1938 | — | KEV | < 2.2.34-70.27.1 | 2.2.34-70.27.1 | Feb 24, 2020 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exp |
- CVE-2022-22721Mar 14, 2022affected < 2.2.34-70.41.1fixed 2.2.34-70.41.1
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
- CVE-2022-22720Mar 14, 2022affected < 2.2.34-70.41.1fixed 2.2.34-70.41.1
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
- CVE-2021-39275Sep 16, 2021affected < 2.2.34-70.38.1fixed 2.2.34-70.38.1
ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.
- CVE-2021-30641Jun 10, 2021affected < 2.2.34-70.35.1fixed 2.2.34-70.35.1
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
- CVE-2020-35452Jun 10, 2021affected < 2.2.34-70.35.1fixed 2.2.34-70.35.1
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation
- CVE-2020-1934Apr 1, 2020affected < 2.2.34-70.27.1fixed 2.2.34-70.27.1
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
- affected < 2.2.34-70.27.1fixed 2.2.34-70.27.1
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exp