Security update for apache2
Announcement ID: | SUSE-SU-2022:2302-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves seven vulnerabilities and has one security fix can now be installed.
Description:
This update for apache2 fixes the following issues:
- CVE-2022-26377: Fixed possible request smuggling in mod_proxy_ajp (bsc#1200338)
- CVE-2022-28614: Fixed read beyond bounds via ap_rwrite() (bsc#1200340)
- CVE-2022-28615: Fixed read beyond bounds in ap_strcmp_match() (bsc#1200341)
- CVE-2022-29404: Fixed denial of service in mod_lua r:parsebody (bsc#1200345)
- CVE-2022-30556: Fixed information disclosure in mod_lua with websockets (bsc#1200350)
- CVE-2022-30522: Fixed mod_sed denial of service (bsc#1200352)
- CVE-2022-31813: Fixed mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism (bsc#1200348)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2022-2302=1
-
Basesystem Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2302=1
-
SUSE Package Hub 15 15-SP4
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-2302=1
-
Server Applications Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-2302=1
Package List:
-
openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
- apache2-utils-2.4.51-150400.6.3.1
- apache2-event-2.4.51-150400.6.3.1
- apache2-prefork-2.4.51-150400.6.3.1
- apache2-worker-debuginfo-2.4.51-150400.6.3.1
- apache2-event-debuginfo-2.4.51-150400.6.3.1
- apache2-example-pages-2.4.51-150400.6.3.1
- apache2-worker-2.4.51-150400.6.3.1
- apache2-prefork-debuginfo-2.4.51-150400.6.3.1
- apache2-2.4.51-150400.6.3.1
- apache2-utils-debuginfo-2.4.51-150400.6.3.1
- apache2-devel-2.4.51-150400.6.3.1
- apache2-debuginfo-2.4.51-150400.6.3.1
- apache2-debugsource-2.4.51-150400.6.3.1
-
openSUSE Leap 15.4 (noarch)
- apache2-doc-2.4.51-150400.6.3.1
-
Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
- apache2-utils-2.4.51-150400.6.3.1
- apache2-prefork-2.4.51-150400.6.3.1
- apache2-prefork-debuginfo-2.4.51-150400.6.3.1
- apache2-2.4.51-150400.6.3.1
- apache2-utils-debuginfo-2.4.51-150400.6.3.1
- apache2-debugsource-2.4.51-150400.6.3.1
- apache2-debuginfo-2.4.51-150400.6.3.1
-
SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x x86_64)
- apache2-debugsource-2.4.51-150400.6.3.1
- apache2-event-2.4.51-150400.6.3.1
- apache2-debuginfo-2.4.51-150400.6.3.1
- apache2-event-debuginfo-2.4.51-150400.6.3.1
-
Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64)
- apache2-devel-2.4.51-150400.6.3.1
- apache2-worker-debuginfo-2.4.51-150400.6.3.1
- apache2-debugsource-2.4.51-150400.6.3.1
- apache2-debuginfo-2.4.51-150400.6.3.1
- apache2-worker-2.4.51-150400.6.3.1
-
Server Applications Module 15-SP4 (noarch)
- apache2-doc-2.4.51-150400.6.3.1
References:
- https://www.suse.com/security/cve/CVE-2022-26377.html
- https://www.suse.com/security/cve/CVE-2022-28614.html
- https://www.suse.com/security/cve/CVE-2022-28615.html
- https://www.suse.com/security/cve/CVE-2022-29404.html
- https://www.suse.com/security/cve/CVE-2022-30522.html
- https://www.suse.com/security/cve/CVE-2022-30556.html
- https://www.suse.com/security/cve/CVE-2022-31813.html
- https://bugzilla.suse.com/show_bug.cgi?id=1198913
- https://bugzilla.suse.com/show_bug.cgi?id=1200338
- https://bugzilla.suse.com/show_bug.cgi?id=1200340
- https://bugzilla.suse.com/show_bug.cgi?id=1200341
- https://bugzilla.suse.com/show_bug.cgi?id=1200345
- https://bugzilla.suse.com/show_bug.cgi?id=1200348
- https://bugzilla.suse.com/show_bug.cgi?id=1200350
- https://bugzilla.suse.com/show_bug.cgi?id=1200352