Security News > 2022 > April > QNAP Advises Users to Update NAS Firmware to Patch Apache HTTP Vulnerabilities

Network-attached storage appliance maker QNAP on Thursday said it's investigating its lineup for potential impact arising from two security vulnerabilities that were addressed in the Apache HTTP server last month.

The critical flaws, tracked as CVE-2022-22721 and CVE-2022-23943, are rated 9.8 for severity on the CVSS scoring system and impact Apache HTTP Server versions 2.4.52 and earlier -.

CVE-2022-22721 - Possible buffer overflow with very large or unlimited LimitXMLRequestBody.

CVE-2022-23943 - Out-of-bounds Write vulnerability in mod sed of Apache HTTP Server.

"While CVE-2022-22719 and CVE-2022-22720 do not affect QNAP products, CVE-2022-22721 affects 32-bit QNAP NAS models, and CVE-2022-23943 affects users who have enabled mod sed in Apache HTTP Server on their QNAP device," the Taiwanese company said in an alert published this week.

In the absence of readily available security updates, QNAP has offered workarounds, including "Keeping the default value '1M' for LimitXMLRequestBody" and disabling mod sed, adding that the mod sed feature is disabled by default in Apache HTTP Server on NAS devices running the QTS operating system.

News URL

https://thehackernews.com/2022/04/qnap-advises-users-to-update-nas.html