CVE-2022-36760

NameCVE-2022-36760
DescriptionInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3351-1, DSA-5376-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apache2 (PTS)buster2.4.38-3+deb10u8vulnerable
buster (security)2.4.59-1~deb10u1fixed
bullseye2.4.56-1~deb11u2fixed
bullseye (security)2.4.59-1~deb11u1fixed
bookworm2.4.57-2fixed
bookworm (security)2.4.59-1~deb12u1fixed
sid, trixie2.4.59-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
apache2sourcebuster2.4.38-3+deb10u9DLA-3351-1
apache2sourcebullseye2.4.56-1~deb11u1DSA-5376-1
apache2source(unstable)2.4.55-1

Notes

https://www.openwall.com/lists/oss-security/2023/01/17/6
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-36760

Search for package or bug name: Reporting problems