Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Oracle httpd could mis-handle web requests and expose data
published 4 years ago
Summary
The Oracle Apache httpd web server may incorrectly process certain web requests, which could let attackers read unintended information or tamper with request routing. This affects the main httpd packages and related tools that handle secure connections. Apply the latest updates from Oracle to fix these issues.
What to do
- Update oracle httpd to version 2.2.15-72.el6.tuxcare.els5.
- Update oracle httpd-devel to version 2.2.15-72.el6.tuxcare.els5.
- Update oracle httpd-manual to version 2.2.15-72.el6.tuxcare.els5.
- Update oracle httpd-tools to version 2.2.15-72.el6.tuxcare.els5.
- Update oracle mod_ssl to version 1:2.2.15-72.el6.tuxcare.els5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:OracleLinux:6 | oracle | httpd |
< 2.2.15-72.el6.tuxcare.els5 Fix: upgrade to 2.2.15-72.el6.tuxcare.els5
|
| TuxCare:OracleLinux:6 | oracle | httpd-devel |
< 2.2.15-72.el6.tuxcare.els5 Fix: upgrade to 2.2.15-72.el6.tuxcare.els5
|
| TuxCare:OracleLinux:6 | oracle | httpd-manual |
< 2.2.15-72.el6.tuxcare.els5 Fix: upgrade to 2.2.15-72.el6.tuxcare.els5
|
| TuxCare:OracleLinux:6 | oracle | httpd-tools |
< 2.2.15-72.el6.tuxcare.els5 Fix: upgrade to 2.2.15-72.el6.tuxcare.els5
|
| TuxCare:OracleLinux:6 | oracle | mod_ssl |
< 1:2.2.15-72.el6.tuxcare.els5 Fix: upgrade to 1:2.2.15-72.el6.tuxcare.els5
|
Original advisory text
Fixed CVEs in httpd: CVE-2022-28615, CVE-2022-31813, CVE-2022-26377
- CVE-2022-26377: mod_proxy_ajp: fix HTTP request smuggling
- CVE-2022-28615: fix possible out-of-bounds read in ap_strcmp_match()
- CVE-2022-31813: mod_proxy: preserve original request headers so an upstream knows what
the original request hostname was, and so send X-Forwarded-* headers correctly
- CVE-2022-28615: fix possible out-of-bounds read in ap_strcmp_match()
- CVE-2022-31813: mod_proxy: preserve original request headers so an upstream knows what
the original request hostname was, and so send X-Forwarded-* headers correctly
References
- https://errata.cloudlinux.com/ol6/CLSA-2022-1656430723.html Vendor Advisory
Timeline
Published28 Jun 2022
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2022-1656430723 · OSV
Track software like this
Free during beta