Release of the Apache HTTP server 2.4.58 with fixes for DoS vulnerabilities in HTTP/2

The release of Apache HTTP Server 2.4.58 has been published, featuring 33 changes and addressing three vulnerabilities, two of which are related to the potential for DoS attacks on systems using the HTTP/2 protocol.

• CVE-2023-45802 — creates conditions for exhausting free memory due to delayed memory release after an HTTP/2 stream reset with an RST flag. Since memory is not released immediately after processing the RST flag, but only after the connection is closed, an attacker can significantly increase memory consumption by sending new requests and resetting them with RST packets without closing the connection.
• CVE-2023-43622 — an infinite blockage of HTTP/2 connection processing if it was opened with a sliding window initial size set to 0. This vulnerability can be exploited to cause a denial of service by exhausting the limit on the maximum number of open connections.
• CVE-2023-31122 — a vulnerability in mod_macro that leads to reading data from memory areas outside the allocated buffer.

Among the changes unrelated to security:

• Support for using the WebSocket protocol over the stream in HTTP/2 connections (RFC 8441) has been added in mod_http2. A directive ‘H2WebSockets on|off’ has been proposed to enable WebSocket over HTTP/2.
• A directive ‘H2EarlyHint name value’ has been added to mod_http2 for adding headers in the ‘103 Early Hints’ response.
• A directive ‘H2ProxyRequests on|off’ has been added to mod_http2 to control the enabling of processing HTTP/2 requests in proxy configuration.
• A directive ‘H2MaxDataFrameLen n’ has been added to mod_http2 to limit the maximum size of response bodies in bytes transmitted in a single DATA frame in HTTP/2. By default, the limit is set to 16KB.
• The mime.types file has been updated, linking the extension ‘.js’ to the type ‘text/javascript’ instead of ‘application/javascript’, and adding extensions: ‘.mjs’ (with the type ‘text/javascript’) and ‘.opus’ (‘audio/ogg’). MIME types and extensions used in WebAssembly have been added.
• The mod_tls module (an alternative to mod_ssl implemented in Rust) has been transitioned to use the rustls-ffi library version 0.9.2+.
• A directive ‘MDMatchNames all|servernames’ has been added to the mod_md module for managing MDomains matching with the contents of VirtualHosts.
• A directive ‘MDChallengeDns01Version’ has been added to the mod_md module to select the version of the ACME protocol used during DNS verification.
• The use of the MDChallengeDns01 directive for individual... domains.
• In mod_dav, the directive 'DavBasePath' has been added to configure the path to the root of the WebDav repository.
• In mod_alias, the directive 'AliasPreservePath' has been added for using the full path value of Alias in the Location block.
• In mod_alias, the directive 'RedirectRelative' has been added, allowing redirection using relative paths.
• The ErrorLogFormat directive has added format specifiers %{z} and %{strftime-format}.
• In mod_deflate, the directive 'DeflateAlterETag' has been added to control the modification of ETag when compression is used.
• Performance optimization has been conducted for the function send_brigade_nonblocking().
• In mod_status, duplicate keys 'BusyWorkers' and 'IdleWorkers' have been removed, and a new counter 'GracefulWorkers' has been added.

Source: opennet.ru