The release of Apache HTTP Server 2.4.52 has been published, featuring 25 changes and addressing 2 vulnerabilities:
- CVE-2021-44790 — a buffer overflow in mod_lua that occurs when parsing multipart requests. The vulnerability affects configurations where Lua scripts call the function r:parsebody() to parse the request body, allowing an attacker to achieve a buffer overflow by sending a specially crafted request. No exploit has been detected yet, but this issue could potentially allow code execution on server.
- CVE-2021-44224 — an SSRF (Server Side Request Forgery) vulnerability in mod_proxy, allowing for a redirect of requests to another handler on the same server that accepts connections via Unix Domain Socket in configurations with the 'ProxyRequests on' setting. This issue can also be exploited to trigger a crash by creating conditions for dereferencing a null pointer. The issue affects Apache httpd versions starting from 2.4.7.
The most notable changes not related to security:
- Support for building with OpenSSL 3 library has been added to mod_ssl.
- Improved detection of the OpenSSL library in autoconf scripts.
- In mod_proxy, tunneling protocols now allow disabling half-open TCP connection redirection by setting the 'SetEnv proxy-nohalfclose' parameter.
- Additional checks have been added to ensure that URIs not meant for proxying contain an http/https scheme, while those meant for proxying include a hostname.
- In mod_proxy_connect and mod_proxy, changing the status code after it has been sent to the client is prohibited.
- When sending intermediate responses after receiving requests with the 'Expect: 100-Continue' header, a status of '100 Continue' rather than the current state of the request is ensured in the result.
- Support for CalDAV extensions has been added in mod_dav, where generating properties must consider both document elements and property elements. New functions dav_validate_root_ns(), dav_find_child_ns(), dav_find_next_ns(), dav_find_attr_ns(), and dav_find_attr() have been added, which can be invoked from other modules.
- In mpm_event, the issue of stopping idle child processes after server load spikes has been resolved.
- In mod_http2, regressive changes that lead to incorrect behavior when processing MaxRequestsPerChild and MaxConnectionsPerChild limits have been fixed.
- The capabilities of the mod_md module, used for automating the retrieval and maintenance of certificates using the ACME (Automatic Certificate Management Environment) protocol, have been expanded:
- Support for the ACME External Account Binding (EAB) mechanism has been added, which can be enabled using the MDExternalAccountBinding directive. Values for EAB can be configured from an external JSON file, allowing authentication parameters to remain concealed in the main configuration file. server configuration.
- The 'MDCertificateAuthority' directive ensures that the URL parameter specifies http/https or one of the predefined names ('LetsEncrypt', 'LetsEncrypt-Test', 'Buypass', and 'Buypass-Test').
- The MDContactEmail directive is now allowed within the section.
- Several bugs have been fixed, including a memory leak that occurred during failures when loading a private key.
Source: opennet.ru
