AIX Open Source

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

# ar -vt /usr/lib/libssl.a

rwxr-xr-x     0/0     728674 Apr 19 10:49 2022 libssl.so
rwxr-xr-x     0/0     510766 Apr 19 10:49 2022 libssl.so.0.9.8
rwxr-xr-x     0/0     728674 Apr 19 10:49 2022 libssl.so.1.0.0
rwxr-xr-x     0/0     728674 Apr 19 10:49 2022 libssl.so.1.0.2
rwxr-xr-x     0/0     1030403 Apr 18 16:06 2022 libssl.so.1.1

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

Carl Burnett without success.   

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

Carl Burnett without success.   

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

Carl Burnett without success.   

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

can you please check?

httpd_64: Syntax error on line 154 of /opt/freeware/conf/httpd.conf: Cannot load /opt/freeware/lib64/httpd/modules/mod_ssl.so into server:      0509-130 Symbol resolution failed for /op
t/freeware/lib64/httpd/modules/mod_ssl.so because:0509-136   Symbol SSL_CTX_set_srp_username_callback (number 114) is not exported from    dependent module /usr/lib/libssl.a[libssl.so.1
.1].
        0509-136   Symbol SSL_CTX_set_srp_cb_arg (number 115) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SSL_set_srp_server_param (number 116) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SSL_get_srp_username (number 117) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SSL_get_srp_userinfo (number 118) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SRP_user_pwd_free (number 310) is not exported from
                   dependent module /usr/lib/libcrypto.a[libcrypto.so.1.1].
        0509-021 Additional errors occurred but are not reported.
        0509-192 Examine .loader section symbols with the
                 'dump -Tv' command.

Carl Burnett without success.   

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

can you please check?

httpd_64: Syntax error on line 154 of /opt/freeware/conf/httpd.conf: Cannot load /opt/freeware/lib64/httpd/modules/mod_ssl.so into server:      0509-130 Symbol resolution failed for /op
t/freeware/lib64/httpd/modules/mod_ssl.so because:0509-136   Symbol SSL_CTX_set_srp_username_callback (number 114) is not exported from    dependent module /usr/lib/libssl.a[libssl.so.1
.1].
        0509-136   Symbol SSL_CTX_set_srp_cb_arg (number 115) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SSL_set_srp_server_param (number 116) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SSL_get_srp_username (number 117) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SSL_get_srp_userinfo (number 118) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SRP_user_pwd_free (number 310) is not exported from
                   dependent module /usr/lib/libcrypto.a[libcrypto.so.1.1].
        0509-021 Additional errors occurred but are not reported.
        0509-192 Examine .loader section symbols with the
                 'dump -Tv' command.

Carl Burnett without success.   

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,

can you please check?

openssl.base            1.1.2.1202

httpd_64: Syntax error on line 154 of /opt/freeware/conf/httpd.conf: Cannot load /opt/freeware/lib64/httpd/modules/mod_ssl.so into server:      0509-130 Symbol resolution failed for /op
t/freeware/lib64/httpd/modules/mod_ssl.so because:0509-136   Symbol SSL_CTX_set_srp_username_callback (number 114) is not exported from    dependent module /usr/lib/libssl.a[libssl.so.1
.1].
        0509-136   Symbol SSL_CTX_set_srp_cb_arg (number 115) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SSL_set_srp_server_param (number 116) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SSL_get_srp_username (number 117) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SSL_get_srp_userinfo (number 118) is not exported from
                   dependent module /usr/lib/libssl.a[libssl.so.1.1].
        0509-136   Symbol SRP_user_pwd_free (number 310) is not exported from
                   dependent module /usr/lib/libcrypto.a[libcrypto.so.1.1].
        0509-021 Additional errors occurred but are not reported.
        0509-192 Examine .loader section symbols with the
                 'dump -Tv' command.

Carl Burnett without success.   

AIX Toolbox packages are dynamically linked with openssl libraries ( right now with 1.0.2.so but gradually it will be linked with 1.1.so) 
So it's the runtime environment that decides which openssl library is used by the packages.
So as long as the recent openssl 1.0.2* is installed in the machine, it is fine. 

------------------------------
Ayappan P

Original Message:
Sent: Wed July 20, 2022 12:33 PM
From: Scott Gruber
Subject: Please update httpd > httpd-2.4.54

Sanket,

I see the httpd-2.4.54 with it's mod_ssl. I've installed it and looks good - thanks for that. However I see the below :

 Server version:  Apache/2.4.54 (Unix)
 Server built:    Jul  5 2022 02:53:31

 lib/mod_ssl-2.4.54-1.ppc   32bit : OpenSSL 1.0.2t  10 Sep 2019
 lib64/mod_ssl-2.4.54-1.ppc 64bit : OpenSSL 1.0.2t  10 Sep 2019

curl : Apache reports for HTTP   : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u
curl : Apache reports for HTTPS  : Server: Apache/2.4.54 (Unix) OpenSSL/1.0.2u

AIX Servers OpenSSL is :  OpenSSL 1.1.1l  24 Aug 2021

How come curl reports OpenSSL 1.0.2u when the mod_ssl is 1.0.2t ?

Please update httpd to a version greater than 2.4.53.  The vulnerability management platform Tenable is reporting multiple advisories:

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory.

- mod_proxy_ajp: Possible request smugglingInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions. Acknowledgements: Ricter Z @ 360 Noah Lab (CVE-2022-26377)

- read beyond bounds in mod_isapiApache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28330)

- read beyond bounds via ap_rwrite() The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28614)

- Read beyond bounds in ap_strcmp_match()Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-28615)

- Denial of service in mod_lua r:parsebodyIn Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-29404)

- mod_sed denial of serviceIf Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. Acknowledgements: This issue was found by Brian Moussalli from the JFrog Security Research team (CVE-2022-30522)

- Information Disclosure in mod_lua with websocketsApache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. Acknowledgements: The Apache HTTP Server project would like to thank Ronald Crane (Zippenhop LLC) for reporting this issue (CVE-2022-30556)

- mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application. Acknowledgements: The Apache HTTP Server project would like to thank Gaetan Ferry (Synacktiv) for reporting this issue (CVE-2022-31813)

An update to httpd would be appreciated.
Thank you,