CVE-2022-36760

NameCVE-2022-36760
DescriptionInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apache2 (PTS)buster2.4.38-3+deb10u8vulnerable
buster (security)2.4.38-3+deb10u7vulnerable
bullseye2.4.54-1~deb11u1vulnerable
bullseye (security)2.4.52-1~deb11u2vulnerable
bookworm, sid2.4.55-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
apache2source(unstable)2.4.55-1

Notes

[bullseye] - apache2 <no-dsa> (Minor update; update proposed via bullseye-pu)
https://www.openwall.com/lists/oss-security/2023/01/17/6
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-36760

Search for package or bug name: Reporting problems