CVE-2022-28614CWE-190CWE-200

read beyond bounds via ap_rwrite()

published June 8, 2022

CVSS
—
EPSS
5%
Percentile
92.2
In the wild
Unconfirmed
What it is

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04977 · 92.2th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-06-08T10:00Z
EPSS history
Timeline
  • 08 JUN 10:00Z
    read beyond bounds via ap_rwrite()
    cvelistv5