Apache Server Security Update 18 January 2023

Apache HTTP Server version 2.4.54 and earlier is vulnerable to several attacks such as HTTP request smuggling, HTTP response splitting, and denial of service attacks.

The severity of the mentioned vulnerabilities could allow the attacker to gain access to the affected systems and cause a denial of service.

Sample of the addressed vulnerabilities:

1. Apache HTTP Server mod_proxy_ajp HTTP Request Smuggling (CVE-2022- 36760):

• CVSS: 7.5

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: None

• User Interaction: None

• Consequences: Gain Access

2. Apache HTTP Server mod_proxy Response Splitting (CVE-2022-37436):

• CVSS: 6.1

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: None

• User Interaction: Required

• Consequences: Gain Access