Description
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache HTTP Server
unspecified to ≤ 2.4.53affected
References
- https://httpd.apache.org/security/vulnerabilities_24.html ↗
- http://www.openwall.com/lists/oss-security/2022/06/08/5 ↗
- https://security.netapp.com/advisory/ntap-20220624-0005/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPY2BLEVJWFH34AX77ZJPLD2OOBYR6ND/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/ ↗
- https://security.gentoo.org/glsa/202208-20 ↗