CVE-2022-22720
critical · 9.8Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
9.8
CVSS
28.2%
EPSS (exploit prob.)
98th
EPSS percentile
2022-03-14
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-444
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apache | http_server | <= 2.4.52 |
| fedoraproject | fedora | 34 |
| fedoraproject | fedora | 35 |
| fedoraproject | fedora | 36 |
| debian | debian_linux | 9.0 |
| oracle | enterprise_manager_ops_center | 12.4.0.0 |
| oracle | http_server | 12.2.1.3.0 |
| oracle | http_server | 12.2.1.4.0 |
| oracle | zfs_storage_appliance_kit | 8.8 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | mac_os_x | 10.15.7 |
| apple | macos | < 10.15.7 |
| apple | macos | >= 11.0, < 11.6.6 |
| apple | macos | >= 12.0, <= 12.4 |
Check a specific version with /api/v1/cve/match.
References
- http://seclists.org/fulldisclosure/2022/May/33
- http://seclists.org/fulldisclosure/2022/May/35
- http://seclists.org/fulldisclosure/2022/May/38
- http://www.openwall.com/lists/oss-security/2022/03/14/3
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/
- https://security.gentoo.org/glsa/202208-20
- https://security.netapp.com/advisory/ntap-20220321-0001/
- https://support.apple.com/kb/HT213255
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213257
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://seclists.org/fulldisclosure/2022/May/33
- http://seclists.org/fulldisclosure/2022/May/35
- http://seclists.org/fulldisclosure/2022/May/38
- http://www.openwall.com/lists/oss-security/2022/03/14/3
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-22720