{"id":91158,"date":"2020-08-09T01:43:01","date_gmt":"2020-08-08T23:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej"},"modified":"2020-08-09T01:43:01","modified_gmt":"2020-08-08T23:43:01","slug":"reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","title":{"rendered":"Vyd\u00e1n\u00ed http serveru Apache 2.4.46 s odstran\u011bn\u00edm zranitelnost\u00ed.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00146.html\">Byl zve\u0159ejn\u011bn<\/a><\/noindex> vyd\u00e1n\u00ed HTTP serveru Apache 2.4.46 (verze 2.4.44 a 2.4.45 byly vynech\u00e1ny), kter\u00e9 zahrnuje <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/CHANGES_2.4.46\">17 zm\u011bn<\/a><\/noindex> a odstran\u011bno <noindex><a rel=\"nofollow\" href=\"http:\/\/httpd.apache.org\/security\/vulnerabilities_24.html\">3 zranitelnosti<\/a><\/noindex>:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00147.html\">CVE-2020-11984<\/a><\/noindex> \u2014 p\u0159ete\u010den\u00ed vyrovn\u00e1vac\u00ed pam\u011bti v modulu mod_proxy_uwsgi, kter\u00e9 m\u016f\u017ee v\u00e9st k \u00faniku informac\u00ed nebo vykon\u00e1n\u00ed k\u00f3du na serveru p\u0159i zas\u00edl\u00e1n\u00ed speci\u00e1ln\u011b upraven\u00e9ho po\u017eadavku. Zranitelnost lze zneu\u017e\u00edt prost\u0159ednictv\u00edm p\u0159enosu velmi dlouh\u00e9ho HTTP hlavi\u010dky. Pro ochranu byla p\u0159id\u00e1na blokace hlavi\u010dek del\u0161\u00edch ne\u017e 16K (omezen\u00ed definovan\u00e9 ve specifikaci protokolu).\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00149.html\">CVE-2020-11993<\/a><\/noindex> \u2014 zranitelnost v modulu mod_http2, kter\u00e1 umo\u017e\u0148uje zhroucen\u00ed procesu p\u0159i zas\u00edl\u00e1n\u00ed po\u017eadavku se speci\u00e1ln\u011b upravenou HTTP\/2 hlavi\u010dkou. Probl\u00e9m se projevuje p\u0159i povolen\u00ed lad\u011bn\u00ed nebo sledov\u00e1n\u00ed v modulu mod_http2 a projevuje se po\u0161kozen\u00edm obsahu pam\u011bti kv\u016fli z\u00e1vodn\u00edmu stavu p\u0159i ukl\u00e1d\u00e1n\u00ed informac\u00ed do logu. Probl\u00e9m se neprojevuje p\u0159i nastaven\u00ed LogLevel na hodnotu \u201einfo\u201c.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00150.html\">CVE-2020-9490<\/a><\/noindex> \u2014 zranitelnost v modulu mod_http2, kter\u00e1 umo\u017e\u0148uje zhroucen\u00ed procesu p\u0159i zas\u00edl\u00e1n\u00ed po\u017eadavku se speci\u00e1ln\u011b upravenou hodnotou hlavi\u010dky 'Cache-Digest' p\u0159es HTTP\/2 (zhroucen\u00ed nast\u00e1v\u00e1 p\u0159i pokusu prov\u00e9st operaci HTTP\/2 PUSH pro zdroj). Pro zablokov\u00e1n\u00ed zranitelnosti lze pou\u017e\u00edt nastaven\u00ed \u201eH2Push off\u201c.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00148.html\">CVE-2020-11985<\/a><\/noindex> \u2014 zranitelnost mod_remoteip, kter\u00e1 umo\u017e\u0148uje spoofing IP adres p\u0159i proxying, pomoc\u00ed mod_remoteip a mod_rewrite. Probl\u00e9m se projevuje pouze pro verze od 2.4.1 do 2.4.23.\n<\/ul>\n<p>Nejv\u00fdznamn\u011bj\u0161\u00ed zm\u011bny, kter\u00e9 nejsou spojeny s bezpe\u010dnost\u00ed: <\/p>\n<ul>\n<li class=\"l\"> Podpora konceptu \u010dern\u00e9 specifikace byla odstran\u011bna z mod_http2 <noindex><a rel=\"nofollow\" href=\"https:\/\/datatracker.ietf.org\/doc\/draft-kazuho-h2-cache-digest\/\">kazuho-h2-cache-digest<\/a><\/noindex>, jej\u00ed propagace byla zastavena.\n<li class=\"l\"> Bylo zm\u011bn\u011bno chov\u00e1n\u00ed direktivy \u201eLimitRequestFields\u201c v mod_http2, zad\u00e1n\u00ed hodnoty 0 nyn\u00ed vyp\u00edn\u00e1 omezen\u00ed.\n<li class=\"l\"> V mod_http2 byla zaji\u0161t\u011bna pr\u00e1ce s hlavn\u00edmi a sekund\u00e1rn\u00edmi (master\/secondary) spojen\u00edmi a ozna\u010dov\u00e1n\u00ed metod v z\u00e1vislosti na pou\u017eit\u00ed.\n<li class=\"l\"> Pokud je obdr\u017eeno nespr\u00e1vn\u00e9 obsah hlavi\u010dky Last-Modified od skriptu FCGI\/CGI, tato hlavi\u010dka je nyn\u00ed odstran\u011bna, nam\u00edsto aby byla nahrazena epoch\u00e1ln\u00edm \u010dasem (Unix epoch).\n<li class=\"l\"> Do k\u00f3du byla p\u0159id\u00e1na funkce ap_parse_strict_length() pro p\u0159\u00edsnou anal\u00fdzu velikosti obsahu.\n<li class=\"l\"> Ve mod_proxy_fcgi v ProxyFCGISetEnvIf byla zaji\u0161t\u011bna odstran\u011bn\u00ed prom\u011bnn\u00fdch prost\u0159ed\u00ed, pokud dan\u00fd v\u00fdraz vrac\u00ed False.\n<li class=\"l\"> Byl odstran\u011bn z\u00e1vod a mo\u017en\u00fd p\u00e1d mod_ssl p\u0159i pou\u017eit\u00ed klientsk\u00e9ho certifik\u00e1tu ur\u010den\u00e9ho nastaven\u00edm SSLProxyMachineCertificateFile.\n<li class=\"l\"> Byl odstran\u011bn \u00fanik pam\u011bti v mod_ssl.\n<li class=\"l\"> V mod_proxy_http2 bylo zaji\u0161t\u011bno pou\u017eit\u00ed parametru proxy \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/httpd.apache.org\/docs\/2.4\/mod\/mod_proxy.html\">ping<\/a><\/noindex>\u201e p\u0159i kontrole funk\u010dnosti nov\u00e9ho nebo znovu pou\u017eiteln\u00fd spojen\u00ed s backendem.\n<li class=\"l\"> Bylo zastaveno propojen\u00ed httpd s volbou \u201e-lsystemd\u201c, pokud je aktivov\u00e1n mod_systemd.\n<li class=\"l\"> V mod_proxy_http2 byla zohledn\u011bna konfigurace ProxyTimeout p\u0159i \u010dek\u00e1n\u00ed na p\u0159\u00edchoz\u00ed data prost\u0159ednictv\u00edm spojen\u00ed s backendem.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Zdroj: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53517\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 17 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2020-11984 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_proxy_uwsgi, \u043a\u043e\u0442\u043e\u0440\u043e\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u043e\u0447\u0435\u043d\u044c \u0434\u043b\u0438\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430. \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91158","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-08T23:43:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-08T23:43:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vyd\u00e1n\u00ed http serveru Apache 2.4.46 se odstran\u011bn\u00edm zranitelnost\u00ed | ProHoster","description":"Bylo vyd\u00e1no vyd\u00e1n\u00ed HTTP serveru Apache 2.4.46 (vyd\u00e1n\u00ed 2.4.44 a 2.4.45 byla p\u0159esko\u010dena), ve kter\u00e9m.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-08T23:43:01+00:00","article:modified_time":"2020-08-08T23:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91158","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:24","updated":"2022-09-28 03:36:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/91158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=91158"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/91158\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=91158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=91158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=91158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}