Update Apache on virtual appliance

General
, ,
1

Hey everybody,

our security team reported some CVE’s on the apache HTTP-Server.
The advisories state that all versions < 2.4.53 are affected.
→ dCERT - Meldung 2022-0523 - Apache HTTP Server: Mehrere Schwachstellen

The current installed version of apache on our virtual appliance is 2.4.25

user@server:~# apachectl -V
Server version: Apache/2.4.25 (Debian)

Is it possible to update the apache manually to a new version if available, or must we wait for the next virtual appliance version?

Regards
Andreas

2

Hello Andreas,

As usual for appliances if you do changes you will not have any vendor support anymore.
I would challenge Tribe29 with the CVEs

regards

Michael

3

The linked advisory looks very suspicious :smiley:
No reference no description nothing. If you look for the ID of the advisory you find anything but nothing about an Apache problem.

4

It is not suspicious :wink:
dcert.de is the official site from “Deutsche Telekom Security GmbH” for security advisories.
If you have an login, you are able to see more information.

Here are the CVE-Numbers and some more links:
CVE-2022-22719, CVE-2022-22720, CVE-2022-22721, CVE-2022-23943

Hope these provide you the needed information.

5

With Debian, the upstream version number is not always the relevant criterium for vulnerable vs. fixed.
In some cases, the Debian security team “backports” fixes from later versions to keep the installed version (feature-)stable. This would then be reflected in the Debian-specific part of the version string while the upstream version number would remain unchanged

You can check the Debian security tracker for apache2 for the CVE-IDs.

But, as others already said, since it’s an appliance, you should probably ask tribe29.

6

The one of the things what i don’t want on a reliable source of information.

Also if you look at one very actual (not released distribution) like the next Ubuntu LTS you will only have Apache 2.4.52 inside (at the moment).
But i had a look at my Ubuntu server patches today and they got today all the fixed Apache version backported to 2.4.41, these fixes are the same inside the actual Debian versions.

1 Like
7

Hi,
as of writing this reply debian has not published updates for this vulnerability and the distro used by the appliance. (See Information on source package apache2)

Unfortunately the information about these vulnerabilities is a bit scarce, but from what I found three vulnerabilities do not matter for the appliance:

CVE-2022-23943 applies only to mod_sed which is not used
CVE-2022-22719 applies only to mod_lua which is not used
CVE-2022-22721 applies only to LimitXMLRequestBody which is not used

The fourth CVE-2022-22720 is still pretty high (9.8). We will look into releasing a new version with the fixes.

1 Like
8

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.