CVE-2022-30556

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.53 and earlier

Description The issue is related to the r:wsread() function in the mod lua module of the Apache HTTP Server, which may return lengths that point past the end of the allocated buffer storage. This can allow a remote attacker to gain unauthorized access to protected information. The vulnerability is associated with insufficient protection of service data.

Recommendations For Apache HTTP Server versions 2.4.53 and earlier, consider disabling the r:wsread() function in the mod lua module as a temporary workaround until a patch is available. Restrict access to the mod lua module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.