CVE-2022-26377

NameCVE-2022-26377
DescriptionInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs1012513

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apache2 (PTS)buster2.4.38-3+deb10u8fixed
buster (security)2.4.38-3+deb10u7vulnerable
bullseye2.4.54-1~deb11u1fixed
bullseye (security)2.4.52-1~deb11u2vulnerable
bookworm2.4.54-3fixed
sid2.4.54-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
apache2sourcebuster2.4.38-3+deb10u8
apache2sourcebullseye2.4.54-1~deb11u1
apache2source(unstable)2.4.54-11012513

Notes

https://www.openwall.com/lists/oss-security/2022/06/08/2
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-26377
https://github.com/apache/httpd/commit/f7f15f3d8bfe3032926c8c39eb8434529f680bd4

Search for package or bug name: Reporting problems