{"id":27597,"date":"2022-01-13T11:07:14","date_gmt":"2022-01-13T11:07:14","guid":{"rendered":"https:\/\/www.n-able.com\/?p=27597"},"modified":"2022-06-10T18:03:07","modified_gmt":"2022-06-10T17:03:07","slug":"january-2022-patch-tuesday","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday","title":{"rendered":"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year"},"content":{"rendered":"

Welcome to the first Patch Tuesday of 2022! Microsoft may have been a little stingy with our December presents, but they\u2019ve made up for it this month with a substantial increase in the number of flaws addressed, including a potentially devastating wormable flaw in the HTTP Protocol Stack (HTTP.sys) used by the Windows Internet Information Services (IIS) that has the potential to be quickly weaponized and deployed by threat actors. We\u2019ll dive deeper into that in a moment.<\/p>\n

In this edition, Microsoft has released fixes for 97 vulnerabilities that include nine Critical and 88 Important classifications. There are also six zero-day vulnerabilities that were publicly disclosed and will need patching. Luckily, none of them is under active exploitation, which gives defenders an opportunity to patch systems before any exploits begin. However, most have proof-of-concept exploits already available, so there is only a narrow window of opportunity to get ahead of attackers.<\/p>\n

Microsoft vulnerabilities<\/h2>\n

It\u2019s going to be another busy month for teams dedicated to patching. Not only is there an increase in vulnerabilities being addressed, but there should also be a sense of urgency behind getting two of the potentially more damaging vulnerabilities addressed quickly, with a total of 14 being marked as Exploitation More Likely that should not be escaping your attention.<\/p>\n

The two most notable vulnerabilities for the month are CVE-2022-21907<\/span><\/a>, the previously mentioned HTTP.sys vulnerability, and CVE-2022-21840<\/span><\/a>,<\/span> which is a Microsoft Office remote code execution vulnerability that only requires a user to open an office file or view the file in Windows Explorer\u2019s preview pane.<\/p>\n

CVE-2022-21907 HTTP.sys vulnerability is marked as Exploitation More Likely and has the potential to be wormable based on how it works. An attacker who successfully sends a specially crafted packet to a target Windows server and executes an attack can use the affected system to replicate the attack on other targets. The vulnerability affects Windows 10, Windows 11, Server 2019, and Server 2022, so even though IIS is typically only in use on Windows servers, there is still the chance that workstations may be leveraging IIS, meaning an audit of both server and workstation Windows OS is warranted.<\/p>\n

Microsoft also issued fixes for three remote code execution vulnerabilities (CVE-2022-21846<\/span><\/a>, CVE-2022-21855<\/span><\/a>, CVE-2022-21969<\/span><\/a>) in Exchange Server. While these are marked as Exploitation More Likely, they all appear to require an attacker to already have a substantial foothold in or access to an environment prior to exploitation. This is in stark contrast to ProxyShell from last year, which was an RCE, so these don\u2019t have the same level of urgency. Nonetheless, it should still be a priority item for the month.<\/p>\n

Vulnerability prioritization<\/h2>\n

As always, it is important to not just prioritize vulnerabilities based on their severity but also their exploitation likelihood. Vulnerabilities marked Exploitation More Likely <\/i>are as important, and some may say even more important, to address quickly due to their increased likelihood to cause actual impacts to an environment. These CVEs from Microsoft should be top of the list as they are all marked as Exploitation More Likely, Exploitation Detected, or Critical.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

CVE<\/strong><\/p>\n<\/td>\n

\n

Description<\/strong><\/p>\n<\/td>\n

\n

Exploitability<\/strong><\/p>\n<\/td>\n

\n

Severity<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21969<\/a><\/span><\/p>\n<\/td>\n

\n

Microsoft Exchange Server RCE<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21919<\/a><\/span><\/p>\n<\/td>\n

\n

Windows User Profile Service Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21916<\/a><\/span><\/p>\n<\/td>\n

\n

Windows Common Log File System Driver Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21914<\/a><\/span><\/p>\n<\/td>\n

\n

Windows Remote Access Connection Manager Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21908<\/a><\/span><\/p>\n<\/td>\n

\n

Windows Installer Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21907<\/a><\/span><\/p>\n<\/td>\n

\n

HTTP Protocol Stack Remote Code Execution<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Critical<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21903<\/a><\/span><\/p>\n<\/td>\n

\n

Windows GDI Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21897<\/a><\/span><\/p>\n<\/td>\n

\n

Windows Common Log File System Driver Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21887<\/a><\/span><\/p>\n<\/td>\n

\n

Win32k Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21885<\/a><\/span><\/p>\n<\/td>\n

\n

Windows Remote Access Connection Manager Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21882<\/a><\/span><\/p>\n<\/td>\n

\n

Win32k Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21881<\/a><\/span><\/p>\n<\/td>\n

\n

Windows Kernel Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21855<\/a><\/span><\/p>\n<\/td>\n

\n

Microsoft Exchange Server Remote Code Execution<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Important<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21846<\/a><\/span><\/p>\n<\/td>\n

\n

Microsoft Exchange Server Remote Code Execution<\/p>\n<\/td>\n

\n

Exploitation More Likely<\/p>\n<\/td>\n

\n

Critical<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21840<\/a><\/span><\/p>\n<\/td>\n

\n

Microsoft Remote Code Execution<\/p>\n<\/td>\n

\n

Exploitation Less Likely<\/p>\n<\/td>\n

\n

Critical<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21917<\/a><\/span><\/p>\n<\/td>\n

\n

HEVC Video Extensions Remote Code Execution<\/p>\n<\/td>\n

\n

Exploitation Less Likely<\/p>\n<\/td>\n

\n

Critical<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2021-22947<\/a><\/span><\/p>\n<\/td>\n

\n

Open Source Curl Remote Code Execution<\/p>\n<\/td>\n

\n

Exploitation Less Likely<\/p>\n<\/td>\n

\n

Critical<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21857<\/a><\/span><\/p>\n<\/td>\n

\n

Active Directory Domain Services Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation Less Likely<\/p>\n<\/td>\n

\n

Critical<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21898<\/a><\/span><\/p>\n<\/td>\n

\n

DirectX Graphics Kernel Remote Code Execution<\/p>\n<\/td>\n

\n

Exploitation Less Likely<\/p>\n<\/td>\n

\n

Critical<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21912<\/a><\/span><\/p>\n<\/td>\n

\n

DirectX Graphics Kernel Remote Code Execution<\/p>\n<\/td>\n

\n

Exploitation Less Likely<\/p>\n<\/td>\n

\n

Critical<\/p>\n<\/td>\n<\/tr>\n

\n

CVE-2022-21833<\/a><\/span><\/p>\n<\/td>\n

\n

Virtual Machine IDE Drive Elevation of Privilege<\/p>\n<\/td>\n

\n

Exploitation Less Likely<\/p>\n<\/td>\n

\n

Critical<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Cumulative updates<\/h2>\n

KB5009566<\/a><\/span> for Windows 11 includes a servicing stack update to resolve problems with Windows Updates. There is a known issue with some image editing software not rendering colors correctly on HDR displays, so any media\/content creation workstations may need to defer this cumulative update until resolved in late January. KB5009543<\/span><\/a> and KB500945<\/span><\/a> for Windows 10 also include a servicing stack update for Windows Update.<\/p>\n

End of service for Windows 10 2004<\/h2>\n

Here is a final reminder that Windows 10 Version 2004 received its last security update in December 2021 because it has now hit EOS. Looking for this and other end-of-service builds of Windows 10 should be a part of regular audits of environments.<\/p>\n

Log4j still lingers<\/h2>\n

The fallout from CVE-2021-44228<\/span><\/a> carries on as threat actors continue to leverage it to deliver both old and new payloads<\/span><\/a>. Because of how easy the Log4j vulnerability is to exploit, this isn\u2019t something attackers will stop using anytime soon. Unfortunately, there are still a large number of vulnerable systems out there with enterprise, SMB, and even federal agencies still struggling<\/span><\/a> to identify at-risk systems. The FTC is even warning<\/span><\/a> those who fail to take due care when addressing Log4j vulnerabilities may be falling foul of the Gramm Leach Bliley Act and face legal action.<\/p>\n

Summary<\/h2>\n

As always, make sure you have established patching processes for evaluation, testing, and pushing into production. If you have traditionally only dealt with patches by applying them based on their severity, consider including prioritization of patches for Zero-Days, Exploitation Detected and Exploitation More Likely vulnerabilities in your Patch Management<\/span><\/a> routines.<\/p>\n

Lewis Pope is the head security nerd at N‑able. You can follow him on:<\/i><\/p>\n

Twitter:\u00a0<\/i>@cybersec_nerd<\/i><\/span><\/a><\/span><\/p>\n

LinkedIn:\u00a0<\/i>thesecuritypope<\/i><\/span><\/a><\/span><\/p>\n

Twitch:\u00a0<\/i>cybersec_nerd<\/i><\/span><\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Potentially devastating flaw in the HTTP Protocol Stack used by Windows IIS is the center point of 2022\u2019s first Patch Tuesday. Lewis Pope takes a deep dive into this month\u2019s…<\/p>\n","protected":false},"author":62,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-27597","post","type-post","status-publish","format-standard","hentry","topic-head-nerds","topic-patch-management","topic-security"],"acf":[],"yoast_head":"\nJanuary 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year - N-able<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year - N-able\" \/>\n<meta property=\"og:description\" content=\"Potentially devastating flaw in the HTTP Protocol Stack used by Windows IIS is the center point of 2022\u2019s first Patch Tuesday. Lewis Pope takes a deep dive into this month\u2019s...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2022-01-13T11:07:14+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-06-10T17:03:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/04\/blog-Lewis-Pope.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"720\" \/>\n\t<meta property=\"og:image:height\" content=\"356\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Lewis Pope\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/04\/blog-Lewis-Pope.jpg\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lewis Pope\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday\"},\"author\":{\"name\":\"Lewis Pope\",\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/person\/32c214c92846fdd7b16459b9236c12ae\"},\"headline\":\"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year\",\"datePublished\":\"2022-01-13T11:07:14+00:00\",\"dateModified\":\"2022-06-10T17:03:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday\"},\"wordCount\":1072,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#organization\"},\"articleSection\":[\"Head Nerds\",\"Patch Management\",\"Security\"],\"inLanguage\":\"it-IT\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday\",\"url\":\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday\",\"name\":\"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year - N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#website\"},\"datePublished\":\"2022-01-13T11:07:14+00:00\",\"dateModified\":\"2022-06-10T17:03:07+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Head Nerds\",\"item\":\"https:\/\/www.n-able.com\/it\/blog\/category\/head-nerds-it\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/it\/#website\",\"url\":\"https:\/\/www.n-able.com\/it\/\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/it\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/it\/#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/it\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/it\/#\/schema\/person\/32c214c92846fdd7b16459b9236c12ae\",\"name\":\"Lewis Pope\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g\",\"caption\":\"Lewis Pope\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year - N-able","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday","og_locale":"it_IT","og_type":"article","og_title":"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year - N-able","og_description":"Potentially devastating flaw in the HTTP Protocol Stack used by Windows IIS is the center point of 2022\u2019s first Patch Tuesday. Lewis Pope takes a deep dive into this month\u2019s...","og_url":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2022-01-13T11:07:14+00:00","article_modified_time":"2022-06-10T17:03:07+00:00","og_image":[{"width":720,"height":356,"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/04\/blog-Lewis-Pope.jpg","type":"image\/jpeg"}],"author":"Lewis Pope","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/04\/blog-Lewis-Pope.jpg","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Scritto da":"Lewis Pope","Tempo di lettura stimato":"5 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday"},"author":{"name":"Lewis Pope","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/person\/32c214c92846fdd7b16459b9236c12ae"},"headline":"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year","datePublished":"2022-01-13T11:07:14+00:00","dateModified":"2022-06-10T17:03:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday"},"wordCount":1072,"publisher":{"@id":"https:\/\/www.n-able.com\/it\/#organization"},"articleSection":["Head Nerds","Patch Management","Security"],"inLanguage":"it-IT"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday","url":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday","name":"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/it\/#website"},"datePublished":"2022-01-13T11:07:14+00:00","dateModified":"2022-06-10T17:03:07+00:00","breadcrumb":{"@id":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.n-able.com\/it\/blog\/january-2022-patch-tuesday#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Head Nerds","item":"https:\/\/www.n-able.com\/it\/blog\/category\/head-nerds-it"},{"@type":"ListItem","position":2,"name":"January 2022 Patch Tuesday: Wormable HTTP.SYS vulnerability rings in the new year"}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/it\/#website","url":"https:\/\/www.n-able.com\/it\/","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/it\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/it\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/it\/#organization","name":"N-able","url":"https:\/\/www.n-able.com\/it\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/person\/32c214c92846fdd7b16459b9236c12ae","name":"Lewis Pope","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g","caption":"Lewis Pope"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts\/27597","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/users\/62"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/comments?post=27597"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts\/27597\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/media?parent=27597"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}