CVE-2022-30556

Public on 2022-06-09

Modified on 2022-10-25

Description

A flaw was found in the mod_lua module of httpd. The data returned by the wsread function may point past the end of the storage allocated for the buffer, resulting in information disclosure.

Severity

Low

See what this means

CVSS v3 Base Score

5.3

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory
Amazon Linux 2 - Core	httpd	2022-07-06 03:12	ALAS2-2022-1812
Amazon Linux 2023	httpd	2023-02-17 20:46	ALAS2023-2023-072
Amazon Linux 1	httpd24	2022-06-30 23:38	ALAS-2022-1607

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	CVSSv2	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N
NVD	CVSSv3	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Red Hat: CVE-2022-30556 Mitre: CVE-2022-30556 FAQs regarding Amazon Linux ALAS/CVE Severity