Apache HTTP server 2.4.62 has been released, addressing two vulnerabilities and introducing six changes. The first vulnerability (CVE-2024-40898) allows for an SSRF (Server-side request forgery) attack on mod_rewrite. This issue manifests only on the Windows platform and, when specially crafted requests are sent, may lead to NTLM hash leaks to an attacker-controlled server.
The second vulnerability (CVE-2024-40725) allows for viewing the code of scripts processed using the AddType directive. For example, a specially crafted request to a PHP script can lead to its content being displayed instead of executed. The fix blocks an additional exploitation avenue for the CVE-2024-39884 vulnerability, which was addressed in version 2.4.61.
Among unrelated security changes, the addition of support in mod_ssl for loading certificates and keys from storages that support the pkcs11 standard stands out.
According to Netcraft's June report, approximately 212 million sites are running on Apache HTTP server (down from 228 million a year ago). Apache httpd's market share is estimated at 19.28% of all sites, making it the second most popular in this category (with Nginx at 21.35%, Cloudflare at 11.05%, and OpenResty (a platform based on Nginx and LuaJIT) at 0.79%). When only considering active sites, Apache ranks first with a share of 19.13% (compared to Nginx's 18.09%, Cloudflare's 14.80%, and Google's 10.01%). Among the top million most visited websites in the world, Apache is in third place with a share of 19.69% (with Cloudflare leading at 23.10% and Nginx at 20.50%).
Mənbə: opennet.ru
