vulnerability

Amazon Linux AMI: CVE-2022-37797: Security patch for lighttpd (ALAS-2023-1705)

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
Sep 12, 2022
Added
Mar 23, 2023
Modified
May 21, 2025

Description

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Solution

amazon-linux-upgrade-lighttpd
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.