Taiwanese vendor QNAP warns users to update their NAS Firmware to address Apache HTTP vulnerabilities, tracked as CVE-2022-22721 and CVE-2022-23943, addressed in the Apache HTTP server in March.
“While CVE-2022-22719 and CVE-2022-22720 do not affect QNAP products, CVE-2022-22721 affects 32-bit QNAP NAS models, and CVE-2022-23943 affects users who have enabled mod_sed in Apache HTTP Server on their QNAP device.” reads the advisory published by the vendor.
The flaws are a possible buffer overflow in LimitXMLRequestBody and an out-of-bounds write vulnerability in mod_sed of Apache HTTP. Both vulnerabilities received a CVSS severity score of 9.8 and affect Apache HTTP Server versions 2.4.52 and earlier. Apache foundation addressed the issue in March 2022 with the release of version 2.4.53.
Below are the descriptions for both issues reported in the changelog:
The company also recommends mitigating CVE-2022-22721 by keeping the default value “1M” for LimitXMLRequestBody, while CVE-2022-23943 can be mitigated by disabling mod_sed.
Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform
(SecurityAffairs – hacking, QNAP)