CVE-2022-22720 is a critical vulnerability affecting Apache HTTP Server versions up to and including 2.4.52. This security issue exposes servers to HTTP Request Smuggling, which could lead to potential attacks on various systems, including those running macOS Catalina, Fedora 35, and other configurations. To protect your system, it's essential to update to the latest version of the affected software.

How do I know if I'm affected?

If you're wondering whether you're affected by the vulnerability, you'll need to check your software versions. The vulnerability impacts Apache HTTP Server versions up to and including 2.4.52, Fedora versions 34, 35, and 36, Debian Linux version 9.0, Oracle products like Enterprise Manager Ops Center and HTTP Server, and Apple macOS versions up to 10.15.7 and from 11.0 up to 11.6.6. If you're using any of these software versions, your system may be at risk.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your software to the latest version. For Apache HTTP Server, upgrade to version 2.4.54 or later. On macOS, install Security Update 2022-004 Catalina. For Fedora users, update the httpd package to version 2.4.53-1.fc35 or later. Always keep your software up-to-date to stay protected.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, CVE-2022-22720 is in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability, named the Apache HTTP Server HTTP Request Smuggling Vulnerability, was added on March 14, 2022. While there is no specific due date or required action mentioned, it is highly recommended to update the affected software to a version that includes a fix for the vulnerability to protect your system.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-444, and is related to the inconsistent interpretation of HTTP requests, known as HTTP Request Smuggling. It affects Apache HTTP Server version 2.4.52 and earlier.

For more details

CVE-2022-22720 is a critical vulnerability affecting various software configurations, including Apache HTTP Server, Fedora, Debian Linux, Oracle products, and Apple macOS. To ensure your system's security, it's essential to update the affected software to the latest version. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina

• Fedora 35 Update: httpd-2.4.53-1.fc35

• Apache HTTPD: Multiple Vulnerabilities (GLSA 202208-20) — Gentoo security

• About the security content of Security Update 2022-004 Catalina - Apple Support