Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to bypass security restrictions and obtain sensitive information due to multiple vulnerabilities.

IBM HTTP Server (powered by Apache) for IBM i is vulnerable to bypass security restrictions due to failure to send headers (CVE-2022-31813), read unintended memory due to large inputs to ap_rwrite() function (CVE-2022-28614), and read buffer beyond bound due to large input to ap_strcmp_match() (CVE-2022-28615). Each of these vulnerabilities are described in the vulnerability details section. IBM i has addressed the CVEs by providing fixes to the Apache HTTP Server implementation as described in the remediation/fixes section.